20

I've read a whole bunch of articles and SO questions on importing 3rd party go packages which all seems straight forward, but what I don't understand is that none that I have read make any references to versioning. In Dartlang there's the pubspec file that defines your package including its version and its dependencies including their required versions. What if I do a go get github.com/gorilla/sessions and write my app then 6 months later I have to clear my directories and re get everything again, in which time that package has been update and broken backwards compatibility with my code that was using the older version?

2 Answers 2

25

The official version, from the GO FAQ:

If you're using an externally supplied package and worry that it might change in unexpected ways, the simplest solution is to copy it to your local repository. (This is the approach Google takes internally.) Store the copy under a new import path that identifies it as a local copy.

There are many alternative to that approach, mainly based on declaring the exact version of those projects you are using.

See for instance "Dead Simple Dependencies in Go -- Keep it simple and keep your sanity." (based on emil2k/vend)

The main different options for Go Dependency Management are listed at:

"Go Package Management -- A summary of dependency management in Go"
(And its associate GOPM mailing list)

Update July 2015:

Update Q4 2017: as mentioned below, go dep is the official tool for pinning version of dependencies (even though that pinning approach is not without criticism: see "The cargo cult of versioning").
It should be merged into the toolchain when Go 1.10 development begins, according to its roadmap.

Update Q2 2018: go dep has been replaced by go mod (modules) in Go 1.11, following works on vgo.

6
  • +1 for including good links. I like using gopkg.in (mentioned in your last link), as it seems to be a sane way to declare "what version do I want?", as "what commit hash do I want?" is somewhat cryptic to new developers using something you've written. Commented Feb 25, 2015 at 5:40
  • A nitpick: the recent communications debacle happened when "go modules" were officially announced, revealed that the Go core team never really intended to merge go dep and considered it as a communitiy-driven experiment to explore what will work and what won't. The sad news is that Sam Boyer, who is the main person behind godep and Russ Cox of the core team failed to make this idea be understood the same way on both ends of the conversation. TL;DR, godep was a "blessed experiment" but not more than that.
    – kostix
    Commented Sep 27, 2018 at 13:58
  • @kostix Yes: If you want more details, I found that thread interesting: twitter.com/sdboyer/status/1034893100450291713 (also in threadreaderapp.com/thread/1034893100450291713.html). Plus the screencast twitter.com/sdboyer/status/1034893103080071169.
    – VonC
    Commented Sep 27, 2018 at 14:29
  • Please note that that's just one side of the story—and, sadly, a highly biased one, for the supposedly obvious reasons,—and the other one may be studied, say, here—in the twitter thread linked from there.
    – kostix
    Commented Sep 27, 2018 at 15:18
  • 1
    @Dominic Simply by tagging your source with labels following the semver convention (semver.org) and pushing them back (github.com/golang/go/wiki/…) See github.com/golang/go/wiki/Modules#publishing-a-release
    – VonC
    Commented Jun 3, 2019 at 18:44
2

I use dep as a dependency management tool for golang project. Please use the following link dep tool for more info.

dep is a dependency management tool for Go. It requires Go 1.9 or newer to compile.

dep was the "official experiment." The Go toolchain, as of 1.11, has (experimentally) adopted an approach that sharply diverges from dep. As a result, we are continuing development of dep, but gearing work primarily towards the development of an alternative prototype for versioning behavior in the toolchain.

Current status: January 2019

dep is safe for production use.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.