Tempted to say that gopack should reject dependencies that don't declare a branch, tag, or commit. But it's probably sufficient to output a stern warning of the dangers of pinning to master in this case. That's a separate issue though.