Hacker News Reader

This didn't directly answer my question, but it implies that you just periodically update all of your dependencies to the latest versions and pray your tests pass with minimal changes required.

Yes?

View on HN

The tools essentially causes that to happen (its a bad thing). When someone installs your package (and you don't pin them somehow with something like godeps, path management, http://labix.org/gopkg.in, etc) you recursively retrieve the deps from some source at HEAD and that package is now updated for every other package using that GOPATH.

Oh, I misread the parent I replied to. I thought he was saying he downloads a copy of his dependencies and commits them to his repository without any tooling.

But he was only saying he uses the tools (which auto-update as your run them), and commits the result as a poor man's pinning arrangement.

Makes sense now. My questions are moot.

Reply on news.ycombinator.com