[go] How does Go update third-party packages?