You've been able to refer to specific versions for as long as vendoring has been used (Godep was first released in 2013 so at least that long, if not longer) and Go has supported it natively with Go modules since Go 1.11 (2019).