I think vgo allows you exclude specific versions in go.mod. It only works for specific versions, not ranges though
> Exclusions only apply to builds of the current module. If the current module were required by a larger build, the exclusions would not apply.