This is not true. If you pass -mod=vendor, or place it in $GOFLAGS, go will build something outside of GOPATH, in module mode, using the vendor directory exclusively. I wish it was the default, but only because it encourages people to not use vendor directories (which is a bad habit), not because it can't be worked around easily.
But that's not what I'm asking. I want "go build" (with some flags) to use my fork (vendored if needed) for one library, and pick up all other dependencies from the module cache as usual. How do I that?
Because this is already possible in a vendor-only world; I just edit the code in vendor.
Look in /usr/include. There you can see what's wrong with GOPATH, 5 years in the future. Now try installing 2 different versions of libraries.
I'll wait.
They aren't, not having them is.