The current problem though is that it requires all your code + all the dependencies to be under $GOPATH/src. https://github.com/golang/go/issues/33655 starts with: "At this time, the godoc command is only able to display packages that are located in a GOPATH workspace."
would not it be easier and cleaner to use the Android's REPO tool [1] to pin down the versions and layout your workspace?
At least the REPO allows you to write down the dependency information in a declarative manner instead of Makefile scripting snippets.
Tainted mode for Javascript and tools for identifying DOM XSS (similar to DOMinator) would be really useful for security testing and audits of the modern complex sites. There is a bug open https://bugzilla.mozilla.org/show_bug.cgi?id=811877 - hopefully it can be given sufficiently high attention and priority!