Stage 1 · Code

Packages, Modules & Concurrency Intro

Go Modules

Create and manage modules with go.mod, add dependencies, keep go.sum honest, and understand versioning.

8 min readProgramming Foundations (Go)Code

go mod init

A module is a tree of Go packages with a version. It is defined by a go.mod file at the root. The module path is usually the repository URL — this ensures globally unique import paths.

Create a new module


mkdir my-tool
cd my-tool
go mod init github.com/thesyscoder/my-tool

cat go.mod

After init, go.mod contains the module path and the minimum Go version. You will add dependencies to it as you go get packages.

Goa-freshly-initialized-go.mod.go

4 linesLn 1, Col 1Go

The module path (`github.com/thesyscoder/my-tool`) is the prefix for all import paths in this module. The `go` directive sets the minimum Go language version.

Adding Dependencies

go get downloads a dependency and records it in go.mod. go mod tidy removes unused dependencies and adds missing ones based on your actual import statements.

Adding a dependency


# Add the latest version
go get github.com/fatih/color@latest

# Add a specific version
go get github.com/fatih/color@v1.16.0

# After editing imports, sync go.mod
go mod tidy

@latest resolves to the newest tagged release. go mod tidy is safe to run any time — it only changes go.mod and go.sum.

Gogo.mod-after-adding-a-dependency.go

14 linesLn 1, Col 1Go

Direct dependencies appear in the first `require` block. Their transitive dependencies appear with `// indirect` in a separate block. `go mod tidy` manages these automatically.

go.sum and Reproducibility

go.sum records the cryptographic hash of every module version your build depends on. Go verifies these hashes on every build, ensuring you always get exactly the code you first approved — even years later.

Commit both go.mod and go.sum

Both files must be committed to version control. go.mod defines what you want; go.sum proves you got it. Committing go.sum is what makes Go builds reproducible across machines and CI environments.

Updating and Tidying

Updating and cleaning up


# Update a specific dependency to latest
go get github.com/fatih/color@latest

# Update all direct dependencies
go get -u ./...

# Remove unused dependencies, add missing ones
go mod tidy

# See what changed
git diff go.mod go.sum

go get -u ./... upgrades everything transitively — use with care in production projects. Prefer upgrading one dependency at a time and reviewing the change.

Vendoring

Vendoring copies all dependencies into a vendor/ directory in your module root. This makes builds self-contained and reproducible even without network access.

Creating and using a vendor directory


# Copy all dependencies into vendor/
go mod vendor

# Build using the vendor directory (skips network and cache)
go build -mod=vendor ./...

# Verify vendor matches go.sum
go mod verify

Some organizations require vendoring for audit, air-gapped environments, or container builds that must not pull from the internet. Most teams use the module cache instead.

Command	What it does
`go mod init`	Creates go.mod with the module path
`go get pkg@version`	Adds or updates a dependency
`go mod tidy`	Syncs go.mod to actual imports
`go mod vendor`	Copies dependencies to vendor/
`go mod verify`	Checks go.sum hashes against cached modules
`go list -m all`	Lists all direct and indirect dependencies

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.