From the faq: https://golang.org/doc/faq#get_version https://golang.org/doc/faq#get_version > If you're using an externally supplied package and worry that it

From the faq: https://golang.org/doc/faq#get_version https://golang.org/doc/faq#get_version > If you're using an externally supplied package and worry that it might change in unexpected ways, the simplest solution is to copy it to your local repository. (This is the approach Google takes internally.) Store the copy under a new import path that identifies it as a local copy. For example, you might copy "original.com/pkg" to "you.com/external/original.com/pkg". The gomvpkg program is one tool to help automate this process.