Hacker News Reader

And crucially, in these systems you are given an escape hatch (declaring versions that are not ok), which vgo does not support.

I think vgo allows you exclude specific versions in go.mod. It only works for specific versions, not ranges though

There are exclusions, but they are only available for the current module:

> Exclusions only apply to builds of the current module. If the current module were required by a larger build, the exclusions would not apply.