I strongly believe the "commit hash" method should be preferred as in the current Guidelines (and obviously not a "last solution")
About the "Git Submodules", I think this is directly conflicting with the "no bundled" Guidelines.