On the contrary, I absolutely want to quickly and easily know if my corporate codebase is depending on github/<random user>. Golang has a pretty solid standard

On the contrary, I absolutely want to quickly and easily know if my corporate codebase is depending on github/<random user>. Golang has a pretty solid standard library and process to extend it. The 'x' packages are all reasonably vetted and close to official libraries: https://pkg.go.dev/golang.org/x https://pkg.go.dev/golang.org/x You could easily make a decree in a codebase that you won't depend on random github code and only use stuff from trusted sources like standard library, x, etc.