They are minimum versions. rclone should be compatible with any version with the same major release, though that does depend on the upstream not breaking backwards compatibility.
Talking google.golang.org/api specifically if you look at the beta you'll see the requirement is now v0.3.2. Not sure where you got googleapis/google-api-go-client as rclone doesn't depend on that (it may have done in the past)
I update the dependencies early in the release cycle.
Note that all the dependencies are vendored so you have exactly the right version in the vendor directory which will automatically be used when compiling without go modules.
Thanks Nick, sounds like it will be safe to upgrade golang api to 0.5.0 then.
As for googleapis/google-api-go-client, as far as I'm aware it's the source repo. There's also https://code.googlesource.com/google-api-go-client but it doesn't provide source tarballs (I build with Debian, which traditionally builds from tarballs).