totally, I'm trying to find the best solution to track branches. I know bundler internally works with commits, probably for similar reasons, SHAs are easier to track. But then they also make you be explicit when you want to upgrade a dependency.

Do you think it would be a good idea to force you to be explicit when you want to track branches, ala `bundle update`? That would be the easier solution. As you mention we can also check the dependencies that don't use commits and run `go get` on them all the time, which I still find annoying. I don't really know which path we should take, tbh.