Go Dependency Management — Managing Dependencies with go mod and Vendoring Strategies

In this tutorial, you will learn about Go Dependency Management. We cover key concepts, practical examples, and best practices to help you master this topic.

Go dependency management uses go mod for version control, replace directives for local overrides, and vendor directories for reproducible builds.

What You'll Learn

• Workspace mode for multi-module
• replace and exclude directives
• Private module handling
• Dependency audit and updates

Why It Matters

Managing dependencies is critical for project health. Docker manages hundreds of Go deps. DodaZIP uses replace directives for local library development.

Real-World Use

Multi-module monorepos, private library development, forking dependencies, air-gapped builds.

Workspace Mode

# go.work file for multi-module development
go 1.22

use (
    ./app
    ./libs/common
    ./libs/auth
)

Replace Directive

// go.mod
module myapp

go 1.22

require (
    example.com/lib v1.0.0
)

replace example.com/lib => ../lib

Private Modules

# Configure private module access
export GOPRIVATE=github.com/mycompany/*
export GONOSUMCHECK=github.com/mycompany/*
export GONOSUMDB=github.com/mycompany/*

# .netrc for authentication
machine github.com login USER password TOKEN

Audit Dependencies

# Check for vulnerabilities
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

# List direct dependencies
go list -m all

# Show dependency graph
go mod graph

Go workspaces accelerate multi-module development by allowing you to work on multiple modules simultaneously without publishing changes.