"pad-left" is not just "somebody changed some code we depend on", it was a trivial little library that was removed and broke half the npm world. Libraries change and code breaks, that's not news.
Plus the Go community's quasi-official position as of 1.4.2 was still that you should vendor your dependencies, and "you should vendor your code" is the official position now. If your code broke because of a remote commit on the internet, that's your build system's problem, not the internet's.
