I'm not making any judgements on the project itself, or its dependencies, but I see a lot of people just use code off github (or butbucket, or launchpad) with n

I'm not making any judgements on the project itself, or its dependencies, but I see a lot of people just use code off github (or butbucket, or launchpad) with no regard for the quality of said code. Just because it's on github doesn't mean it's good code, or the maintainer has any idea what they're doing. In general, if I can't trust a project to maintain a stable master branch (or a Go version tag) following best practice guidelines, I'm not going to trust that code in my project without a full review. In that case, I'd fork it (or clone it into another VCS) and work from there. There are some issues with the way the Go tooling handles dependencies, but I think the minimalist way in which it does is very useful, and easy to build upon. Go uses a distributed dependency system, and you can't give it the same level of trust you give to centralized repositories, like one does with gems, Pypi, NPM, CPAN, and so on.