A History of Dependency Management: 1.0 to Workspaces
summary
Chronicles Go dependency management from GOPATH chaos through the 2016 left‑pad fallout to official modules and recent workspace support, showing what changed and why: third‑party tools like dep (deprecated 2020) and vgo lead to modules introduced in go1.11 and finalized in 1.13 with go.mod and go.sum files, default proxy at proxy.golang.org and checksum DB at sum.golang.org, optional vendoring via go mod vendor, and local development grouping with go.work added in 1.18; recommends modules, selective vendoring, workspaces for multi‑repo workflows, and emerging vulnerability scanning.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:58Dynamic Dependency
- 20:21Summary of the Go Sum File
- 20:55Usage of Proxies and a Hash Database and the Indexes
- 21:20Hash Database
- 23:13Little Copying Is Better than a Little Dependency
- 27:23Vulnerability Management
related talks
38mUsing Go Modules in everyday life
06mLightning Talk: Getting The Most Out Of Go Tool Dependencies
51mDependency Management
46mRediscovering Go
24m"Finding Dependable Go Packages"
32mSecure and reliable development with Go
51mKeynote | State of the Go Nation
06mLightning Talk: Paying Down Debt: Converting Kubernetes To Use Go "Workspaces"