godep and vendoring completely solved this problem.

Go modules relies too heavily on dependencies being good citizens, which is a very naive approach to dependency management.