This is why you should vendor your dependencies. They are part of your codebase at that point.
Re:The Everything NPM Package
by speedgoose on Sunday January 07, 2024 @07:16AM
(#38900610)
I have better things to do though. This feels unnecessary.
“go mod vendor”.
That’s it. That’s all you need to do.
Re:The Everything NPM Package
by speedgoose on Sunday January 07, 2024 @02:33PM
(#38904373)
Oh like this. I’m not sure I would enjoy overloading my git repository and merge requests with the dependencies. I was thinking about having a proxy or forking all the dependencies.
The thing is though that those dependencies are part of your code. Seeing how they're changing through PRs and commits is actually a feature IMHO and not a bug.
> I'm also unsure of what is going to happen over time as dependencies may be moved or removed
That's what the Go module proxy is for. The authors can move or remove their repositories as much as they want, I as a dependent am not bothered by it. They would have to go through an official vetted process to get it removed from the proxy.
Re:The Everything NPM Package
by speedgoose on Sunday January 07, 2024 @07:18AM
(#38900620)
Oh I didn’t know that the proxy.golang.org was a thing. That’s good to know.
Not having a registry is neat, but I'm also unsure of what is going to happen over time as dependencies may be moved or removed. You can see that with old Maven pom.xml where some dependencies do not resolve anymore.