The approach here would be to declare the dependency on the git repo directly. Vendoring is still going to copy the stuff you're building into your project, but you'd keep those patches in the repository of the dependency, not on your vendored copy.
The key thing here is being able to do it through multiple levels of dependency, for which I see someone else provided me an answer that is actionable! \o/
