title: Golang Dependency Management Best Practice
body: <p>In Golang, we can specify open source libraries on GitHub as dependencies. For example:</p>
  
  <pre><code>import "github.com/RichardKnop/somelibrary"
  </code></pre>
  
  <p>This will try to look for a branch based on your Go version and default to master if I understand correctly.</p>
  
  <p>So there is no way to import a specific release of a dependency, e.g.:</p>
  
  <pre><code>import "github.com/RichardKnop/somelibrary#v1.4.8"
  </code></pre>
  
  <p>What is the best practise to manage dependencies in Go then?</p>
  
  <p>I can see two approaches.</p>
  
  <h2>I. Version Modules</h2>
  
  <p>Is it to create new modules for major versions with breaking changes?</p>
  
  <p>For example, my Go library could define modules v1 and v2 so then you could do:</p>
  
  <pre><code>import "github.com/RichardKnop/somelibrary/v1"
  </code></pre>
  
  <p>Or:</p>
  
  <pre><code>import "github.com/RichardKnop/somelibrary/v2"
  </code></pre>
  
  <p>Based on what you need. Any changes made to v1 or v2 would be required not to break any APIs or working functionality.</p>
  
  <h2>II. Forking</h2>
  
  <p>This would give you a complete control over a version of external dependency your Go code requires.</p>
  
  <p>For example, you could fork github.com/RichardKnop/somelibrary into your own GitHub account and then in your code do:</p>
  
  <pre><code>import "github.com/ForkingUser/somelibrary"
  </code></pre>
  
  <p>Then you would have to fork all external dependencies which seems a bit overkill. However it would give you total control over versions. You could keep your forks at a version you know is working with your code and only update forks once you have checked that new releases of dependencies do not break anything.</p>
  
  <p>Thoughts?</p>