Go has all of that code in its runtime. Rust does not. Hence, you need to get that code somehow, and packages are how you do that.

Your lock file should ensure that the exact same versions of everything are used a year from now. So it should work with no hell. That being said, with async/await five weeks away, the ecosystem is about to get a massive upgrade, and so you will be behind unless you built this all with the pre-release versions of stuff. That said, unless you’re doing active development on the project, that shouldn’t matter, and if you are, you can schedule some time to do the upgrade, like anything else.