Go has a feature called vendoring. Say you depends on a dozen packages; call ‘go mod vendor` and it’ll download the versions of them all upon which you depend - you then add them to the project repo, check ‘em in… and the project becomes entirely compilable without external dependencies. You can continue to upgrade dependencies as the project continues; each time, it now downloads the new version and you commit it. It’s a neat trick almost nobody uses.