But this is exactly what 'go mod' is NOT doing. It's called 'Minimal Version Selection'. Quoted right from the lead core dev's blog: ' For stable development, today's build list must also be tomorrow's build list.' (https://research.swtch.com/vgo-mvs).

From what I gathered, 'go mod' is the first mainstream tool which is going that way (but I would be glad to be proved wrong!). Other package manager are using lock files which have their caveats (see https://research.swtch.com/cargo-newest.html for an in depth examination of the revered cargo approach on low-fidelity builds).