Menambahkan Dependensi Eksternal

Menemukan Paket

# Search and explore at https://pkg.go.dev

# Popular packages:
# github.com/gin-gonic/gin        — HTTP framework
# github.com/stretchr/testify     — test assertions
# golang.org/x/sync               — extended sync primitives
# github.com/spf13/cobra          — CLI framework
# github.com/jackc/pgx/v5         — PostgreSQL driver

go get: Menambahkan Dependensi

# Add latest version
go get github.com/stretchr/testify

# Add specific version
go get github.com/stretchr/testify@v1.8.4

# Add a pre-release version
go get github.com/foo/bar@main

# go get updates go.mod:
# require github.com/stretchr/testify v1.8.4

Menggunakan Dependensi

package main

import (
    "fmt"
    "github.com/stretchr/testify/assert"
    "testing"
)

func TestAdd(t *testing.T) {
    assert.Equal(t, 4, 2+2, "math should work")
    fmt.Println("assertion done")
    _ = assert.New // suppress unused import
}

go mod download

# Download all deps from go.mod
go mod download

# Download specific module
go mod download github.com/gin-gonic/gin@v1.9.1

# Useful for:
# - Docker layer caching (copy go.mod/go.sum first, then download)
# - Pre-warming CI cache
# - Offline development setup

Pemilihan Versi Semantik: MVS

# If A requires gin v1.9.0
# and B requires gin v1.9.1
# MVS selects v1.9.1 (minimum that satisfies both)

# To upgrade ALL dependencies to latest minor/patch:
go get -u ./...

# To upgrade specific package:
go get -u github.com/gin-gonic/gin

go mod why — Menjelaskan Dependensi

# Why is encoding/json needed?
go mod why encoding/json

# Why is golang.org/x/net needed?
go mod why golang.org/x/net

# Output shows the import chain:
# github.com/myapp
# github.com/gin-gonic/gin
# golang.org/x/net

go mod vendor untuk Kompilasi yang Dapat Direproduksi

# Vendor all deps
go mod vendor

# Build only from vendor (no network)
go build -mod=vendor ./...

# Dockerfile pattern:
# COPY go.mod go.sum ./
# RUN go mod download
# COPY . .
# RUN go build ...

Modul Privat dengan GONOSUMCHECK dan GOPRIVATE

# Tell Go not to use proxy/sumdb for private modules
export GOPRIVATE=github.com/mycompany/*
export GONOSUMCHECK=github.com/mycompany/*

# Or in go env:
go env -w GOPRIVATE=github.com/mycompany/*

# For enterprise Go proxy:
export GOPROXY=https://proxy.mycompany.com,direct

go clean -modcache

# Clear entire module cache
go clean -modcache

# Clear cache for specific version
go clean -modcache github.com/gin-gonic/gin@v1.9.1

# Useful when:
# - Cache is corrupted
# - Testing with a fresh environment
# - Disk space cleanup

Memeriksa Kerentanan: govulncheck

# Install govulncheck
go install golang.org/x/vuln/cmd/govulncheck@latest

# Scan your module
govulncheck ./...

# Output example:
# Vulnerability #1: GO-2023-1234
# github.com/foo/bar v1.2.3
# Fixed in: v1.2.4
# Suggestion: go get github.com/foo/bar@v1.2.4

Pemeriksaan Singkat

Ringkasan: Dependensi Eksternal