Dependencies with Go modules

What a dependency is

A dependency is someone else's module that your code uses, for example a router, a database driver or a UUID generator. Go downloads modules from their source (usually a Git repository) through a module proxy, by default proxy.golang.org, a Google-run cache that keeps versions available even if the original repo disappears.

Adding a dependency

go get github.com/google/uuid@latest
go mod tidy

package main

import (
	"fmt"

	"github.com/google/uuid"
)

func main() {
	fmt.Println("order id:", uuid.NewString())
}

module example.com/orders

go 1.24

require github.com/google/uuid v1.6.0

go.sum: fingerprints

go.sum lists a cryptographic hash for every module version your build uses. If a download ever differs from the recorded hash, the build stops. Go also checks hashes against a public checksum database (sum.golang.org), so a malicious change to a published version would be noticed. Commit go.sum together with go.mod.

Semantic versions

Go's rule for major versions: from v2 on, the module path ends with /v2, /v3 and so on. So v4 and v5 of pgx are different import paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5), and a program can even use both during a migration.

Everyday commands

How Go picks versions

Go uses minimal version selection: for each module it picks the lowest version that satisfies every requirement in the build, not the newest one available. Builds therefore stay the same until someone deliberately changes go.mod. There is no separate lock file; go.mod plus go.sum is the lock.

Staying safe

• Prefer the standard library when it is good enough. Every dependency is code you must trust and update.
• Check a library before adding it: recent commits, a clear licence, real users, tests.
• Run govulncheck regularly. It reports known vulnerabilities that your code actually calls: go install golang.org/x/vuln/cmd/govulncheck@latest, then govulncheck ./...
• For private company repositories, set GOPRIVATE (for example GOPRIVATE=github.com/yourcompany/*) so Go fetches them directly and does not send their names to the public proxy or checksum database.