opened
ByteFlinger
username_0
I am trying to download a direct dependency using `dep ensure` however rather than getting version specified in the Gopkg.toml, it gets the latest version instead of the one specified in the repo

I have `Gopkg.toml` in the root of my application which contains a few packages. My git repository lives at `git.com/myrepo.git` (Obviously not the actual value) and my project imports `git.com/myrepo.git/package1` and `git.com/myrepo.git/package2`

I have the following in my Gopkg.toml

```toml
[[constraint]]
  name = "git.com/myrepo.git"
  version = "0.0.2"
```
I run `git tag -l` under `git.com/myrepo.git`

```
$ git tag -l
0.0.1
v0.0.1
v0.0.2
v0.0.3
```
I go into `$GOPATH/git.com/myrepo.git` and run `dep ensure` and then check the vendor folder and it contains the latest version (`v0.0.3 git tag in this case`)

I check the generated Gopkg.lock and I find the following

```
[[projects]]
  digest = "1:6f20ac242cecd4c8fedd59d8c1551b34ea178503bf172d43592a38c1ab9ce2b2"
  name = "git.com/myrepo.git"
  packages = [
    "package1",
    "package2",
  ]
  pruneopts = "UT"
  revision = "12393bac023361a4043d162d122cdb264d39ab63"
  version = "v0.0.3"
```

I am at a loss on what is going wrong here

### What version of `dep` are you using (`dep version`)?
dep:
 version     : v0.5.0
 build date  : 2018-07-26
 git hash    : 224a564
 go version  : go1.10.3
 go compiler : gc
 platform    : linux/amd64
 features    : ImportDuringSolve=false

### What `dep` command did you run?
`dep ensure`

### What did you expect to see?
Dep downloaded the code pertaining to git tag `v0.0.2`

### What did you see instead?
Dep downloaded the latest tag it found (Which in this case was `v0.0.3`)

```
(10)  ? attempt git.com/myrepo.git with 2 pkgs; 7 versions to try
(11)      try git.com/myrepo.git@v0.0.3
```

### Other relevant info

Go version: 1.11
Dep ignoring Gopkg.toml and downloading latest version instead
issue