Updating untagged Go dependencies

Go dependencies can be referenced by commit instead of a tagged version. How do we keep them up to date?