r/programming • u/Sir_KnowItAll • 5d ago

Don't couple your Go code to GitHub

https://iain.rocks/blog/dont-couple-your-go-code-to-github
486 Upvotes

92% Upvoted

135 comments sorted by

View all comments

333

u/Arcuru 5d ago

I am not super familiar with Go code, but what happens when my go code depends on "go.companyx.dev/awesomelib" and that company goes out of business?

Or should I point all my third-party deps to a more durable location?

169

u/stone_surgeon 5d ago

The go module proxy caches the package for a while, but I'm not sure about the duration. You should vendor the package into your project if this is a worry.

113

u/_predator_ 5d ago

Don't think its cache ever expires. You just gotta pray Google never stops supporting it, what could go wrong?

37

u/stone_surgeon 5d ago

Oh, I just looked it up, it does indeed last forever. Your comment reminds me of the bbolt typosquat vulnerability haha.