If the Go ecosystem has a weak point, it is this. Go dependency management has always been something that requires a lot of attention.
If you do not know, the official repository of the Go dependencies is Git. Exactly, all Git, no matter if it's GitHub, Bitbucket, or any other. The problem is that when downloading a dependency using the Go command (go get ...), the version that will come to the application is always the one in the master repository. So there is no strict control of additions.
A package manager will use godep (https://github.com/tools/godep). This is a simple tool, which controls the versions used in the project guarding a JSON file with the repository URL and hash Git history.
