up to 0.6.2; all go deps are vendored