[jerf]

You own your dependencies and will need to support and audit them in the future.

Note the lack of conditions on that statement, up to and including the fact this statement isn't even about Go, nor is it even about open source! It is simply a fact. You own your dependencies and you need to support and audit them. You are free to support and audit them by not supporting them at all, not auditing them at all, and blindly pulling in whatever random mutations they may go through in the future. You own the consequences of such terrible support. You own the consequences of good support.

[jfolkins]

You are correct and I was unclear. My statement is that you and ONLY you now own them. You've essentially forked the project and lost your community.