I guess using any dependency, directly or transitively, that declares itself pre-1.0 in the go or semver meaning of the word, is thus right out.

At that point, almost all of the go ecosystem can't be used.