how to version packages in golang?

I use dep as a dependency management tool for golang project. Please use the following link dep tool for more info.

dep is a dependency management tool for Go. It requires Go 1.9 or newer to compile.

dep was the "official experiment." The Go toolchain, as of 1.11, has (experimentally) adopted an approach that sharply diverges from dep. As a result, we are continuing development of dep, but gearing work primarily towards the development of an alternative prototype for versioning behavior in the toolchain.

Current status: January 2019

dep is safe for production use.

The official version, from the GO FAQ:

If you're using an externally supplied package and worry that it might change in unexpected ways, the simplest solution is to copy it to your local repository. (This is the approach Google takes internally.) Store the copy under a new import path that identifies it as a local copy.

There are many alternative to that approach, mainly based on declaring the exact version of those projects you are using.

See for instance "Dead Simple Dependencies in Go -- Keep it simple and keep your sanity." (based on emil2k/vend)

The main different options for Go Dependency Management are listed at:

"Go Package Management -- A summary of dependency management in Go"
(And its associate GOPM mailing list)

Update July 2015:

• the official vendoring approach from Go team is discussed here.
• an alternative go build tool called "gb" is proposed at getgb.io by Dave Cheney.

Update Q4 2017: as mentioned below, go dep is the official tool for pinning version of dependencies (even though that pinning approach is not without criticism: see "The cargo cult of versioning").
It should be merged into the toolchain when Go 1.10 development begins, according to its roadmap.

Update Q2 2018: go dep has been replaced by go mod (modules) in Go 1.11, following works on vgo.