Go doesn't mitigate that somehow. You get the code that you specify, not the code that someone else has decided is better. In practice, for both npm and Go de

Go doesn't mitigate that somehow. You get the code that you specify, not the code that someone else has decided is better. In practice, for both npm and Go dependencies, you'll get a Dependabot PR that upgrades the dependency for you. Obviously that is Github-specific, so if you're on a different platform, you'll have to subscribe to security updates in some other way. I am guessing there are many services that you can subscribe to that do the same thing.