I don't think pulling directly from upstream repo is a good idea, since it can always introduce breaking changes or outright malicious code and this will lead to random consumers getting hard to debug errors due to version mismatches between what repo code expects and what gets pulled into a submodule.
So far the only feasible solution is the same as the old one, aka the repo owner @honcho creating a fork in this repo and linking to it through a submodule. This way it will still depend on the upstream repo, but the updates will be controlled.