dep, the prototype for an official Go dependency management tool, has been progressing wonderfully since opening up in January. We’ve had dozens of community members step up with ideas and code, as well as untold numbers more testing out the tool on real workloads - the momentum has been awesome!

dep is in an experimental phase - development has been rapid, and we’ve pivoted in some key ways. And while we’re learning a lot, it’s also been hard for a casual observer to follow. To mitigate that, starting this week, I’m going to (try to) publish a once-weekly update of what all’s going on with dep.

I’ll keep it as short as possible, focusing each post on three areas:

  • General news - state of the roadmap, big changes that are incoming, etc.
  • What needs community attention over this coming week
  • What we’ve finished this past week

Off we go!

News and Such

While it’s important for us to maintain an experimental mindset with dep, we also want it to at least be stable enough that users can feel safe to commit their manifest and lock files. This is the first item on our roadmap, and we’re going to try to get it done by mid-May.

To that end, there’s some big news - I’ve just merged a PR moving from JSON to TOML for the manifest (manifest.json -> Gopkg.toml) and lock (lock.json -> Gopkg.lock) files. This is, of course, a major step towards stabilizing the files.

Also, gps is going to be moving directly into dep as a subpackage. This will make contributing easier, centralize issues into one repository, and shorten dep’s overall development cycle.

Community Attention Needed!

  • As our current focus is on stabilizing the metadata files, the issue for that is where we really need eyeballs. Please feel free to comment on that issue (or ping me, @sdboyer, in the Gophers slack in #vendor) if you’re interested in helping, but it’s not obvious from the issue how to do so.
  • Help with reviewing PRs for general issues, coding style, testing completeness, etc., is VERY helpful. Finding time to do good reviews is currently a huge progress blocker, and if the maintainers can focus our review time only on correctness with respect to the spec, it would be tremendously helpful.
  • Docs! Docs docs docsdocsddocodcsdscosdoocso DOCS. Ideally, folks who are willing to not just write docs, but also willing to take on thinking about how to organize docs sanely.

Stuff We’ve 🚢ed

There’s a lot to put in here, as a number of PRs have landed that have been open for several weeks.

  • We’ve added a dep prune subcommand, which will trim out unneeded packages and files from your vendor/ directory. There’s a better-than-even chance that this command won’t actually stay in dep, because reasons, but it exists for now as part of dep so that we can learn from it as part of the experiment. (patch by @tomwilkie - thank you!)
  • We started splitting gps up into multiple packages. (patch by @narqo - thank you!)
  • I finally finished a large refactor of gps, eliminating some race conditions that were responsible for a number of bugs in dep. (These upstream changes aren’t merged into dep just yet, though). (thanks to @spenczar for patient reviews!)
  • We’ve implemented support for symlinking project roots. This is very basic, and only for the project root, but it should help with some common ways people set up their environments. (patch by @brianstarke - thank you!)
  • We’ve added support for generating dot output from dep status. (patch by @Rhymond - thank you!)