This is what I do in Go. I vendor all of my modules. If it's not in my codebase, it's out of my control. I require control.