Well, Go doesn't have a package system and no good external tool to circumvent it. So the choice is either maintain a fork of every dependency or vendor them,

Well, Go doesn't have a package system and no good external tool to circumvent it. So the choice is either maintain a fork of every dependency or vendor them, and vendoring is considerably less painful imo. (I'm not saying it's a good solution, mind you)