It's not even a Go problem, you can be equally stupid by putting "package": "*" in npm's package.json instead of, say, "package": "1.2"