Hands-On Software Engineering with Golang

Is vendoring always a good idea?

The previous section went into great effort to extol the virtues of vendoring. But is vendoring the panacea for all dependency management problems? This section attempts to dig a bit deeper into some of the caveats associated with vendoring.

One common problem across engineering teams is that in spite of the fact that engineers are keen on vendoring their dependencies, they often forget to periodically refresh them. As I argued in a previous section, all code can contain potential security bugs. It is therefore likely that some security bugs (perhaps from a transitive dependency of an imported package) will eventually end up in production.

Security-related or not, when bugs are reported to the package maintainers, ...