Will be great to see this integrated with the go toolchain eventually, it's something that people coming from other stacks get confused by all the time (particularly dynamic languages which tend to have their own package manager), and for a thriving open source ecosystem I think they need some way of pinning dependencies. It's been interesting for me though just how far you can get without worrying about pinning dependencies - both by restricting those you use, and because everyone has been forced to avoid too many breaking changes, I've run into problems with using the master branch only a few times in a few years of using Go, and it certainly discourages breaking changes if you know that you may well break anyone who depends on your code.