>frequently change without notice Unless you are doing something so spectacularly, mind-blowingly irresponsible in your dependency management that changes just

>frequently change without notice Unless you are doing something so spectacularly, mind-blowingly irresponsible in your dependency management that changes just come in of their own accord (i.e. Go's defaults), no they don't. They change when you choose to vendor the new version or change the pinned version number. It's true that your dependencies won't get security updates until you decide to upgrade, but other people are certainly not writing security updates for your in-house code. You should care about the code quality of the 3rd party libraries you use, with the understanding that you might one day take over maintenance of them, at least for internal purposes. That's still not a reason to duplicate effort.