The dependency management in Golang is handled using go mod. go mod is the official dependency management tool introduced by the Golang team. It assists developers in managing project dependencies to ensure the stability and maintainability of the project code. In go mod, dependencies are categorized into two types based on how packages are imported in the code: direct dependencies and indirect dependencies. Direct dependencies are explicitly referenced in the project code, while indirect dependencies are dependencies of the direct dependencies. Below we will provide detailed explanations of these two types of dependencies.

Direct Dependencies

In Golang, direct dependencies refer to external packages or modules explicitly referenced by the project itself, which are imported directly into the project code. For example, suppose there is a project named myproject that depends on the github.com/pkg/errors package. In the go.mod file of myproject, you can find the following content:

module myproject

require (
	github.com/pkg/errors v0.9.1
)

github.com/pkg/errors is the direct dependency of myproject. When this package is used in the project, it is downloaded and installed locally using go mod.

Indirect Dependencies

Indirect dependencies refer to the packages that are depended upon by the direct dependencies, but the project itself does not directly use them. In other words, indirect dependencies are the packages imported by the project's dependency packages. These dependencies are not directly referenced in the project's code but are necessary for the project's build and execution. Indirect dependencies are typically hidden in the background, and project maintainers do not need to pay direct attention to them.

These dependencies are often marked with the // indirect comment in the go.mod file. Continuing with the example of myproject, if it also depends on the github.com/stretchr/testify package, inspecting the source code of that package may reveal dependencies on other packages. These indirectly depended-upon packages are the indirect dependencies of myproject. In the go.mod file of myproject, you might see something like this:

module myproject

require (
	github.com/pkg/errors v0.9.1
	github.com/stretchr/testify v1.8.4
)

require (
	github.com/davecgh/go-spew v1.1.1 // indirect
	github.com/pmezard/go-difflib v1.0.0 // indirect
	gopkg.in/yaml.v3 v3.0.1 // indirect
)

In the require section below, the packages are all marked with // indirect comments, indicating that these are indirect dependencies of myproject.

Managing indirect dependencies is relatively complex because they are not directly referenced in the project code but are instead referred to through direct dependencies. Without proper management, this could lead to version conflicts or the introduction of unstable dependency packages in the project.

Why are indirect dependencies necessary?

Indirect dependencies ensure compatibility across all packages in the entire project dependency tree. Failure to do so may result in situations where versions of certain library dependencies are incompatible with others.

Recording indirect dependencies ensures that the same dependency versions are obtained every time the application is built, crucial for the reproducibility of builds and deployments.

The Go module system employs an algorithm called Minimal Version Selection(MVS) to determine which version of dependencies will be used. This algorithm favors lower version numbers to reduce potential compatibility risks.

How to manage indirect dependencies?

When adding or updating a dependency, if that dependency itself relies on other packages, go get will automatically calculate and add these indirect dependencies to the go.mod file.

The go mod tidy command removes unnecessary dependencies and adds missing dependencies, both direct and indirect.

The go mod why command helps understand why a particular package exists as a dependency, displaying the dependency chain and explaining the need for a specific indirect dependency.

Summary

In Golang, dependency management is crucial. Direct dependencies are explicitly referenced in the project code, while indirect dependencies are dependencies of direct dependencies. The Go module system effortlessly manages project dependencies, ensuring the stability and maintainability of project code.