[mzl]

And crucially, in these systems you are given an escape hatch (declaring versions that are not ok), which vgo does not support.

[hectormalot]

I think vgo allows you exclude specific versions in go.mod. It only works for specific versions, not ranges though

[mzl]

There are exclusions, but they are only available for the current module:

> Exclusions only apply to builds of the current module. If the current module were required by a larger build, the exclusions would not apply.

https://research.swtch.com/vgo-tour