> In the 6 years since Go 1.0 the only dependency management related change I'm aware of is the addition of `vendor/`.

This. Sure, new tools have appeared, but there's literally nothing wrong if you decide to just stick with godep or whatever you happen to be using.