I've seen that happening, but there is always a risk of the old “gorilla
holding the banana”[1] problem. That is, the library that you use
depends on a library you don't really need, which in turn depends on
another one, etc. Once you had reached gopkg.in/yaml.v2, you've already
lost.
[1] https://www.johndcook.com/blog/2011/07/19/you-wanted-banana/