> What happens when the dependencies have bugfixes or security flaws? Copy the new version into the repository, run the import rewriting script and check it in

> What happens when the dependencies have bugfixes or security flaws? Copy the new version into the repository, run the import rewriting script and check it in. > Why is it better to spread the responsibility for updates over all Go authors instead of to the authors of the libraries in question? Because you want to have full control over your dependencies. What if the author introduces a breaking change or removes the repository from the internet? Do you want to risk your business by being at the mercy of someone else's repository?