[nvarsj]

godep and vendoring completely solved this problem.

Go modules relies too heavily on dependencies being good citizens, which is a very naive approach to dependency management.

[quacker]

You can still do vendoring with Go modules, using the `go mod vendor` command.

[nvarsj]

I'm a bit out of date now, but 'go mod vendor' did not in fact vendor all dependencies when I last used it. It seemed more like a CI caching mechanism then actual complete dependency vendoring.