Golang. Working with go module dependencies

In order to initialize go modules in our project just run the next command

go mod init github.com/<user>/<project>

As a result, go.mod and go.sum will be created. go.mod file describes all the dependencies in the project, as well as the current version of the language and initialized module name.

This file also contains the following elements:

require includes all dependency modules and the associated version that we are going to use in our project.

replace points to the local version of the dependency in Go, not git-web. It will create a local copy of the provider with available versions, so there is no need to install every time we want to refer to the provider.

//indirect implies that we do not use these dependencies inside our project, but there is some module that imports them.

go.sum maintains a checksum, so when we run the project again, it won't install all the packages again. It uses the cache, which is stored in the $GOPATH/pkg/mod directory (module cache directory).

It is possible to create a separate catalog of vendors with available versions. This copies all third-party dependencies to the vendor folder at the root of your project. This adds all the transitive dependencies needed to run the vendor’s package. When vendoring is enabled, the go command will download packages from the vendor directory instead of downloading modules from their sources into the module cache and using the already downloaded packages.

go mod vendor

There is a command to remove installed packages. This command is used to clear the mod cache, which is stored in $GOPATH/pkg/mod. The -modcache flag removes the entire module load cache, including unpacked dependency version source code.

go clean -modcache

To view a list of available package versions

go list -m -versions github.com/pkg/math

To view a list of available versions of all packages that are used in your project

go list -m all

The list of available versions will only be displayed if the package has a release version. In this case, if a package is used that does not have a release version, then go.mod will display an entry in the following format instead of the version - v0.0.0-<timestamp>-<commit-hash> In fact, the availability of a release version can also be found through git commands:

git ls-remote —tags git://github.com/.git | less
git ls-remote —heads git://github.com/.git | less

Upgrading dependency to the latest version

go get example.com/pkg

Upgrading dependency and all its dependencies to the latest version

go get -u example.com/pkg

Viewing available dependency upgrades. It will show you available minor and patch upgrades for all direct and indirect dependencies

go list -u -m all

Upgrading all dependencies at once. To upgrade all dependencies at once for a given module, just run the following from the root of your module. This upgrades to the latest or minor patch release

go get -u ./...

Or we can upgrade test dependencies

go get -t -u ./...

To also upgrade to a specific version using Go modules

go get foo@v1.2.3
go get github.com/pkg/math@v0.3.0

or specifying a commit hash

go get foo@f5801deq7

We can update the package to the latest available version and thus

go get github.com/pkg/math@latest

Thus, given the required version, we can perform downgrading and upgrading. After all such updates and changes in the project code, it is recommended to run the command

go mod tidy

This will then link the current imports in the project and packages listed in go.mod go mod tidy ensures that the go.mod file matches the source code of the module. It adds any missing module requirements needed to build the current module's packages and dependencies, if there are any unused dependencies, go mod tidy will remove them from go.mod accordingly. It also adds any missing entries to go.sum and removes unnecessary entries.