> there should be an easier way to "pin" a dependency, other than vendoring

Put this in your go.mod:

  replace example.com/package-to-pin => example.com/package-to-pin v1.2.3

Then go.sum will do its actual job (along with GOSUMDB) and ensure you only get exactly the revision of the code that you want.