The thing I don't like on this front for Go is the whole "dependencies on Github" thing.

If the dependencies are not vendored or pointing to the correct thing (tags, always tags!), 3 years from now your project might not build.

I like the Maven approach of the immutable binary repo.

One day a long, long time ago, I found a broken dependency from IBM uploaded on the Maven Central repo, I think. I sent the Maven Central repo maintainers a mail saying that the dependency was broken. They replied saying that they don't ever touch uploaded releases. At the time I was kind of pissed off cause it was a transitive dependency that was breaking stuff. I had to hack around it.

But over the years I've come to appreciate that wisdom.

Contrast: npm.