I'd prefer something simper with one command if in the go tool - you should be able to just freeze your current dependencies, then edit the file by hand if require to set a specific version (most people won't). The trouble with dependencies is that there are all sorts of edge cases, but most people never hit them, so why make things complex (with 2 files for example)?