godep and vendoring completely solved this problem.
Go modules relies too heavily on dependencies being good citizens, which is a very naive approach to dependency management.
You can still do vendoring with Go modules, using the `go mod vendor` command.
You can still do vendoring with Go modules, using the `go mod vendor` command.