Go Modules
Go Modules manage dependencies for Go projects by grouping packages that are released, versioned, and distributed together.
What Go Modules is
Go Modules manage dependencies for Go projects by grouping packages that are released, versioned, and distributed together. Each module has a UTF-8 go.mod file at its root, identifying its module path and recording dependency information. Versions normally follow the major.minor.patch semantic-version format. Minimal version selection provides consistent module versions for reproducible builds, and commands that load the module graph update go.mod when needed. A go.work file lets a workspace use multiple modules. Dependencies can be fetched from version-control repositories or proxy servers, with GOPROXY controlling proxy behavior; private sources can be configured with settings such as GOPRIVATE and GONOPROXY. The go command checks downloaded hashes against go.sum, and a mismatch prevents installation. A public checksum database supplies verification entries. Go Modules are free and part of the open-source Go project, distributed under a BSD-style license. Go compilers target systems including Linux, macOS, Windows, Android, and iOS, among others. Since Go 1.21, a toolchain refuses a module that declares a newer Go version than it supports.
Good
- Free as part of the open-source Go project
- Supports multi-module workspaces
- Private module access can be configured
- Checks downloaded hashes against go.sum
- Minimal version selection supports reproducible builds
Watch out
- Since Go 1.21, toolchains reject modules requiring newer Go versions
Who it suits
Go Modules suit developers managing dependencies in Go projects, including teams that need workspaces, private modules, or reproducible builds.
Verdict
Go Modules provide dependency management with version selection, workspaces, and integrity checks. Consider the declared Go version requirement when choosing a toolchain for a module.
The facts
Each one read from Go Modules's own pages, with the date it was checked.
What it does
- Automatic updates
- Commands that load the module graph automatically update go.mod when needed.checked 1 Oct 2026
- Checksum database
- The public checksum database provides a global source of go.sum lines to verify module contents.checked 1 Oct 2026
- Compatibility requirement
- Since Go 1.21, a toolchain refuses to use a module that declares a newer Go version than the toolchain supports.checked 2 Oct 2026
- Dependency file
- Each module is defined by a UTF-8 encoded go.mod file in its root directory.checked 1 Oct 2026
- Dependency metadata
- A module is identified by its module path, declared in a go.mod file together with information about its dependencies.checked 2 Oct 2026
- Dependency resolution
- Yeschecked 21 Sep 2026
- Dependency sources
- Modules may be downloaded directly from version control repositories or from module proxy servers.checked 2 Oct 2026
- Integrity verification
- Downloaded module hashes are checked against go.sum and mismatches produce a security error without installing the file.checked 1 Oct 2026
- License
- Go is an open source project distributed under a BSD-style license.checked 1 Oct 2026
- Lockfile support
- Yeschecked 21 Sep 2026
- Module model
- A module is a collection of packages released, versioned, and distributed together.checked 1 Oct 2026
- Module proxy
- The go command defaults to downloading modules from the public Go module mirror for Go 1.13 and later module users.checked 1 Oct 2026
- Module structure
- A module is a collection of packages that are released, versioned, and distributed together.checked 2 Oct 2026
- Offline installation
- Yeschecked 21 Sep 2026
- Origin
- Go was created at Google in 2007 and released publicly in November 2009.checked 1 Oct 2026
- Package formats
- Go modules,module ZIP fileschecked 21 Sep 2026
- Private dependencies
- The Go Modules reference documents environment variables including GOPRIVATE and GONOPROXY for controlling module lookup behavior.checked 2 Oct 2026
- Private modules
- The go command can download and build modules from private sources with configuration such as GOPRIVATE and GOPROXY.checked 1 Oct 2026
- Private registry auth
- Yeschecked 21 Sep 2026
- Project and license
- Go is an open source project developed by a team at Google and community contributors, and is distributed under a BSD-style license.checked 2 Oct 2026
- Proxy configuration
- The go command's GOPROXY setting can specify proxy URLs or the keywords direct or off.checked 2 Oct 2026
- Purpose
- Go modules are how Go manages dependencies.checked 2 Oct 2026
- Reproducible builds
- Minimal version selection provides consistent module versions and 100% reproducible builds.checked 1 Oct 2026
Money
- Free plan
- Yeschecked 21 Sep 2026
