Russ Cox has published a stack of posts this month laying out "vgo", a proposal for versioned modules in the Go toolchain itself. I've read them twice now, and the short version is that Go is finally getting first-class dependency management, with versions, a module file, and a path out of GOPATH purgatory.
This is a bit awkward for those of us who'd settled on dep. It was billed as the official experiment, the thing to standardise on whilst the team worked out the real answer, and we duly adopted it, checked in Gopkg.toml, and got on with our lives. Now the real answer looks like it'll be something else, with a different approach to version selection ("minimal version selection", which is a genuinely interesting idea worth reading about).
I'm not annoyed, oddly. dep did its job: it kept our builds reproducible whilst the language sorted itself out, and that was always the deal. The migration when modules land will be a faff, but a one-time faff is a fair price for never having to explain GOPATH to a new starter again. For now I'll keep an eye on the proposal and leave dep where it is. No sense rewriting our tooling for something that isn't shipped yet.