Currently,

This is fast on repeated builds:

[[module.imports]]
path    = "github.com/bep/hugo-mod-misc/dummy-content"
version = "v0.2.0"

These are slow on repeated builds (as Go needs to do some redownloading to determine the right version):

[[module.imports]]
path    = "github.com/bep/hugo-mod-misc/dummy-content"
version = ">v0.1.0"

[[module.imports]]
path    = "github.com/bep/hugo-mod-misc/dummy-content"
version = "main"

[[module.imports]]
path    = "github.com/bep/hugo-mod-misc/dummy-content"
version = "latest"

[[module.imports]]
path    = "github.com/bep/hugo-mod-misc/dummy-content"
version = "b930e2b1fd438dc04b3456481d3c2736fdf4388d"

I'm not going to do anything with this right now, but we could

1. Cache the JSON received from Go to disk with a sensible expiry date (e.g. 24h, configurable)
2. Check if the module referenced in the cached JSON still exists on disk, then use that.

The recommended way now is to use semver versions, e.g. v1.0.0. This isn't security concern: We do checksum validation, so if someone tampers with the upstream content and creates a new tag with the same value, the build will fail.

A related tip; to figure out if there are newer version available, you can just temporary setting version = "latest" and then watch the output of hugo mod graph to see what version it resolved to.