Go conflating the two is, I think, its biggest design mistake on the build system side. In Go, dependencies are inferred from imports, which, since it can't express versioning information, leads precisely to this sort of problem.

It makes sense only if you're putting all of your dependencies in a single versioned work tree, but almost no developers work like that outside of Google. And it's not a good pattern for most devs/companies. Yet Go is completely infected by it.

Other languages typically use a dependency manifest, which IMHO is the only sane, logic approach.

The funny thing, a dependency manifest is a superset of Go's current import behavior. But they chose implicit over explicit, which in CS is a mistake 9 times out of 10.