That's not how that works in the Go ecosystem: you don't get that dependency upgrade unless you explicitly upgrade the dependencies of your project. The Go toolchain uses the "Minimum Version Selection" algorithm.

https://research.swtch.com/vgo-mvs