Git submodules can only follow branches. I wanted tags.

LazySubmodules

Track Git submodules by branch, tag, tag pattern or commit, with a lock file that catches moved tags. A command line tool for scripts and a terminal interface for people. Configuration lives in.git...

lazysubmodules.readthedocs.io

FPGArtktic / lazysubmodules

Track git submodules by branch, tag, tag pattern or commit — CLI + TUI with a lock file

LazySubmodules

LazySubmodules manages Git submodules that track branches, tags, tag patterns or fixed commits. It has a scriptable command line interface and an interactive terminal user interface (TUI). The binary is called lazysubmodules, and lsm is an optional short name.

• Tracking modes: a submodule can follow a branch, a tag, the highest version tag matching a glob such as v2.*, or a fixed commit.
• Lock file: .lsm.lock records what each submodule was resolved to, so tags that were moved on the remote are detected.
• Predictable network use: only fetch, update --fetch and add touch the network; everything else works on local refs.
• Native Git underneath: configuration lives in .gitmodules, and all work is done by the git command line tool. Plain git submodule update --remote keeps working for branch-tracking submodules.
• Scripting: a stable, machine-readable status format, verify with optional signature checks, and distinct exit codes.

…

View on GitHub

Git can make a submodule follow a branch, but there is no way to say "follow tag v2.3.1" or "follow the newest v6.6.* release", so everyone pinning submodules to releases does it by hand. I wrote a tool for it: lsm set kernel --tag-pattern 'v6.6.*', then lsm update kernel --fetch --commit. The configuration lives in .gitmodules under keys Git ignores, so anyone who clones without the tool still runs git submodule update --init and gets exactly what the superproject records.