[dbaupp]

Many package managers interpret semver in a similarly mechanical way, e.g. npm, bundler, cargo (and, I think, elm-package, and I'm sure others too), but they choose different versions based on that information.

[mzl]

And crucially, in these systems you are given an escape hatch (declaring versions that are not ok), which vgo does not support.

[hectormalot]

I think vgo allows you exclude specific versions in go.mod. It only works for specific versions, not ranges though

[mzl]

There are exclusions, but they are only available for the current module:

> Exclusions only apply to builds of the current module. If the current module were required by a larger build, the exclusions would not apply.

https://research.swtch.com/vgo-tour