Text file
src/README.vendor
1 Vendoring in std and cmd
2 ========================
3
4 The Go command maintains copies of external packages needed by the
5 standard library in the src/vendor and src/cmd/vendor directories.
6
7 There are two modules, std and cmd, defined in src/go.mod and
8 src/cmd/go.mod. When a package outside std or cmd is imported
9 by a package inside std or cmd, the import path is interpreted
10 as if it had a "vendor/" prefix. For example, within "crypto/tls",
11 an import of "golang.org/x/crypto/cryptobyte" resolves to
12 "vendor/golang.org/x/crypto/cryptobyte". When a package with the
13 same path is imported from a package outside std or cmd, it will
14 be resolved normally. Consequently, a binary may be built with two
15 copies of a package at different versions if the package is
16 imported normally and vendored by the standard library.
17
18 Vendored packages are internally renamed with a "vendor/" prefix
19 to preserve the invariant that all packages have distinct paths.
20 This is necessary to avoid compiler and linker conflicts. Adding
21 a "vendor/" prefix also maintains the invariant that standard
22 library packages begin with a dotless path element.
23
24 The module requirements of std and cmd do not influence version
25 selection in other modules. They are only considered when running
26 module commands like 'go get' and 'go mod vendor' from a directory
27 in GOROOT/src.
28
29 Maintaining vendor directories
30 ==============================
31
32 Before updating vendor directories, ensure that module mode is enabled.
33 Make sure that GO111MODULE is not set in the environment, or that it is
34 set to 'on' or 'auto', and if you use a go.work file, set GOWORK=off.
35
36 Also, ensure that 'go env GOROOT' shows the root of this Go source
37 tree. Otherwise, the results are undefined. It's recommended to build
38 Go from source and use that 'go' binary to update its source tree.
39
40 Requirements may be added, updated, and removed with 'go get'.
41 The vendor directory may be updated with 'go mod vendor'.
42 Tree inconsistencies are reported by 'go test cmd/internal/moddeps'.
43 A typical sequence might be:
44
45 cd src # or src/cmd
46 go get golang.org/x/net@master
47 go mod tidy
48 go mod vendor
49 go test cmd/internal/moddeps
50
51 Use caution when passing '-u' to 'go get'. The '-u' flag updates
52 modules providing all transitively imported packages, not only
53 the module providing the target package.
54
55 Note that 'go mod vendor' only copies packages that are transitively
56 imported by packages in the current module. If a new package is needed,
57 it should be imported before running 'go mod vendor'.
58
59 Go release cycle considerations
60 ===============================
61
62 Applying changes to packages that are vendored follows the considerations
63 written down at go.dev/s/release.
64
65 When the Go tree is open for development, a specific change may be pulled in
66 at any time that it is needed. During the release freeze, the bar for changes
67 in vendored packages is the same as it is for changes in non-vendored packages.
68 After a major release is out, minor Go releases follow a more involved process
69 documented at go.dev/wiki/MinorReleases#cherry-pick-cls-for-vendored-golangorgx-packages.
70
71 In addition to individual updates that happen on demand, all dependencies in
72 the std and cmd modules are updated to their latest available versions at least
73 twice during every major release cycle. This is done to avoid the possibility of
74 some dependencies being left on very old versions and in turn make their eventual
75 update more disruptive. This recurring process is tracked in go.dev/issue/36905.
76 The golang.org/x/build/cmd/updatestd command exists to assist with that process.
77
View as plain text