go mod init github.com/<user>/<project>
As a result, go.mod and go.sum will be created.
go.mod file describes all the dependencies in the project, as well as the current version of the language and initialized module name.
This file also contains the following elements:
require includes all dependency modules and the associated version that we are going to use in our project.
replace points to the local version of the dependency in Go, not git-web. It will create a local copy of the provider with available versions, so there is no need to install every time we want to refer to the provider.
//indirect implies that we do not use these dependencies inside our project, but there is some module that imports them.
go.sum maintains a checksum, so when we run the project again, it won't install all the packages again. It uses the cache, which is stored in the $GOPATH/pkg/mod directory (module cache directory).
It is possible to create a separate catalog of vendors with available versions. This copies all third-party dependencies to the vendor folder at the root of your project. This adds all the transitive dependencies needed to run the vendor’s package. When vendoring is enabled, the go command will download packages from the vendor directory instead of downloading modules from their sources into the module cache and using the already downloaded packages.
go mod vendor
There is a command to remove installed packages. This command is used to clear the mod cache, which is stored in $GOPATH/pkg/mod. The -modcache flag removes the entire module load cache, including unpacked dependency version source code.
go clean -modcache
To view a list of available package versions
go list -m -versions github.com/pkg/math
To view a list of available versions of all packages that are used in your project
go list -m all
The list of available versions will only be displayed if the package has a release version. In this case, if a package is used that does not have a release version, then go.mod will display an entry in the following format instead of the version - v0.0.0-<timestamp>-<commit-hash> In fact, the availability of a release version can also be found through git commands:
git ls-remote —tags git://github.com/.git | less
git ls-remote —heads git://github.com/.git | less
Upgrading dependency to the latest version
go get example.com/pkg
Upgrading dependency and all its dependencies to the latest version
go get -u example.com/pkg
Viewing available dependency upgrades. It will show you available minor and patch upgrades for all direct and indirect dependencies
go list -u -m all
Upgrading all dependencies at once. To upgrade all dependencies at once for a given module, just run the following from the root of your module. This upgrades to the latest or minor patch release
go get -u ./...
Or we can upgrade test dependencies
go get -t -u ./...
To also upgrade to a specific version using Go modules
go get foo@v1.2.3
go get github.com/pkg/math@v0.3.0
or specifying a commit hash
go get foo@f5801deq7
We can update the package to the latest available version and thus
go get github.com/pkg/math@latest
Thus, given the required version, we can perform downgrading and upgrading. After all such updates and changes in the project code, it is recommended to run the command
go mod tidy
This will then link the current imports in the project and packages listed in go.mod go mod tidy ensures that the go.mod file matches the source code of the module. It adds any missing module requirements needed to build the current module's packages and dependencies, if there are any unused dependencies, go mod tidy will remove them from go.mod accordingly. It also adds any missing entries to go.sum and removes unnecessary entries.