go mod vendor without update to latest

Question

I’m trying to figure out if it’s possible to run go mod vendor without the go tool updating my go.mod file.

I specifically go get package/subpackage@commit and commit my go.mod with the correct version.

Then I run go mod vendor and it automatically bumps the version of the package that I just specifically set.

I’ve looked at this page to no avail: https://github.com/golang/go/wiki/Modules#how-do-i-use-vendoring-with-modules-is-vendoring-going-away

I need to use vendor because I run a script that edits some of the vendored deps., I’m looking at the following build flow:

GO111MODULE=on go get package/subpackge@commit
GO111MODULE=on go mod vendor
./Script/patch_vendors.sh --write
GO111MODULE=off go build

My other option is modifying the copied source wherever go mod vendor donwloads it to, but not sure how to approach that.

Thanks in advance

Answer 1

Per https://tip.golang.org/cmd/go/#hdr-Maintaining_module_requirements:

The go command itself automatically updates the go.mod file to maintain a standard formatting and the accuracy of require statements.

Any go command that finds an unfamiliar import will look up the module containing that import and add the latest version of that module to go.mod automatically. […]

Any go command can determine that a module requirement is missing and must be added […].

The go mod vendor command copies in all of the transitive imports of your packages and their tests, so it will automatically update the go.mod file to ensure that all of the imported packages are present.

So the problem here is likely that the commit you've selected for package/subpackage fails to provide some package that appears in the transitive imports of your program. If that is correct, you should find that go list all, go test all, and go mod tidy all make that same edit to your module's requirements.