Or... just keep a clone of the upstream repo right next to your project's repo.

I'm all in favor of removing the runtime dependency on GitHub and similar, but that doesn't inherently require keeping deps in the same repo as the project.