Plus the Go community's quasi-official position as of 1.4.2 was still that you should vendor your dependencies, and "you should vendor your code" is the official position now. If your code broke because of a remote commit on the internet, that's your build system's problem, not the internet's.
I assume you weren't vendoring before... are you vendoring now?