It's an example of how they treat "old" code, services or otherwise. Fixup your code to use new version or you can't build. Replace "build" with "deploy" and you have the policy of GCP. Now it's been a few years and they may have fixed this, but Go was the only language I've ever used that didn't let you pin dependency versions

It's a fair criticism of the older versions of Go - it did not have good dependency management out of the box. Probably due to the famous Google monorepo and how they did not need to tackle that issue head on themselves. However the past few years Go has really addressed this problem, first through the dep project (which has your standard .lock file for pinning dependencies similar to Node) and now go modules (included in the latest Go versions). Now you get dependency management out of the box. Your point is valid but does not reflect the modern state of Go.

You may want to use this small script: "Like 'go get' but with pinned package versions. A tiny shell script".

https://github.com/joewalnes/go-getter