[kaeshiwaza]

Upper bound are major version, everything between should be api compatible (it's in the specs of go modules).

[pcwalton]

Except for version 0.x, and with vgo you have no recourse if somebody didn't follow the rules and made an incompatible change.

[jessaustin]

This is the whole point: just specify the version before the change, and it won't bother you.

[pcwalton]

Until someone actually wants to update their dependencies, writes "go get -u", and breaks the build.

[jessaustin]

Well sure, you probably want to test after updating all of those dependencies. That's a good reason to only update when necessary. Do you argue that some other scheme prevents bugs in dependencies? That hasn't been my experience...