Released on June 13, 2019. We are looking for sponsors!

• Fix an error in the TOML example for the Gopkg.toml documentation. (#2174)

• Fix error when cleaning up git submodules with newer versions of git. Thanks @geearu for the fix. (#2168, #2176)

CHANGELOG: prepare for 0.5.3 release

Fixes #2160.

Released on February 16, 2019

IMPROVEMENTS:

• Add CI tests against go1.11.
• Fix indefinite hang cloning Git repositories that failed fsck checks. (#2070)
• The noverify field in Gopkg.toml allows for the preservation of excess files under vendor. (#2002)
• Add releases for arm, armv6 (#2102), s390x (#2070), and ppc architectures.
• Fix handling of cyclic import graphs (#2003).
• Fix error in preservation of vendor/.git (#2000).
• Fix an edge case in lockdiff where all the projects may be removed from the lock file (#1972).
• Fix panic related to projects. (#1945)

BUG FIXES:

• Correctly handle certain cases where dep ensure removed projects from Gopkg.lock. (#1945).

See the release announcement for an overview of major changes!

NEW FEATURES:

• Add CI tests against go1.10. Drop support for go1.8. (#1620).
• Added install.sh script. (#1533).
• List out of date projects in dep status (#1553).
• Enabled opt-in persistent caching via DEPCACHEAGE env var. (#1711).
• Allow DEPPROJECTROOT environment variable to supersede GOPATH deduction and explicitly set the current project's root (#1883).
• dep ensure now explains what changes to the code or Gopkg.toml have induced solving (#1912).
• Hash digests of vendor contents are now stored in Gopkg.lock, and the contents of vendor are only rewritten on change or hash mismatch (#1912).
• Added support for ppc64/ppc64le.
• New subcommand dep check quickly reports if imports, Gopkg.toml, Gopkg.lock, and vendor are out of sync (#1932).

BUG FIXES:

• Excise certain git-related environment variables. (#1872)

IMPROVEMENTS:

• Add template operations support in dep status template output (#1549).
• Reduce network access by trusting local source information and only pulling from upstream when necessary (#1250).
• Update our dependency on Masterminds/semver to follow upstream again now that Masterminds/semver#67 is merged(#1792).
• inputs-digest was removed from Gopkg.lock (#1912).
• Hash digests of vendor contents are now stored in Gopkg.lock, and the contents of vendor are only rewritten on change or hash mismatch (#1912).
• Don't exclude Godeps folder (#1822).
• Add project-package relationship graph support in graphviz (#1588).
• Limit concurrency of dep status to avoid hitting open file limits (#1923).

v0.4.1 is a hotfix release that addresses a significant omission in v0.4.0: per-project pruning rules in Gopkg.toml were not respected.

In the interest of causing minimal disruption to existing CI infrastructure, this release also restores the original behavior of dep prune. The command is hidden, and the old behavior is still (even without the aforementioned bugfix) inferior to the new, dep ensure-integrated pruning behavior in every way.

However, existing scripts based on dep prune will continue to work using the old behavior, giving users an opportunity to update their scripts without causing undue pain in the process. Note that a future release of dep will remove dep prune entirely, so fix your stuff now 😄

v0.4.0 is a significant milestone for dep. It removes the dep prune command, absorbing its behavior entirely into dep ensure, with additional granular controls. This is an immediate boon for users' workflows, but it also unblocks the path to finishing essential parts of dep's design.

It is strongly recommended that you update your Gopkg.toml to include the new pruning directives as soon as you update to this new version of dep. For most projects, adding this to Gopkg.toml will be fine:

[prune]
  unused-packages = true
  go-tests = true

This will do everything dep prune used to, and more, with fewer bugs.

Less verbose, but equally exciting news: dep init now supports automated conversions from govendor and glock!

Finally, this release includes a new, detailed documentation site!

NEW FEATURES:

• Absorb dep prune into dep ensure. (#944)
• Add support for importing from glock based projects. (#1422)
• Add support for importing from govendor based projects. (#815)
• Allow override of cache directory location using environment variable DEPCACHEDIR. (#1234)
• Add support for template output in dep status. (#1389
• Each element in a multi-item TOML array is output on its own line. (#1461)

BUG FIXES:

• Releases targeting Windows now have a .exe suffix. (#1291)
• Adaptively recover from dirty and corrupted git repositories in cache. (#1279)
• Suppress git password prompts in more places. (#1357)
• Fix -no-vendor flag for ensure -update. (#1361)
• Validate git ls-remote output and ignore all malformed lines. (#1379)
• Support gopkg.in version zero. (#1243)
• Fix how dep status print revision constraints. (#1421)
• Add optional -v flag to ensure sub command's syntax. (#1458)
• Allow URLs containing ports in Gopkg.toml source fields. (#1509)

IMPROVEMENTS:

• Log as dependencies are pre-fetched during dep init. (#1176)
• Make the gps package importable. (#1349)
• Improve file copy performance by not forcing a file sync. (#1408)
• Skip empty constraints during import. (#1414)
• Handle errors when writing status output. (#1420)
• Add constraint for locked projects in dep status. (#962)
• Make external config importers error tolerant. (#1315)
• Show LATEST and VERSION as the same type in status. (#1515)
• Warn when [[constraint]] rules that will have no effect. (#1534)

NEW FEATURES:

• Add support for importing from gvt and gb. (#1149)
• Wildcard ignore support. (#1156)
• Disable SourceManager lock by setting DEPNOLOCK environment variable.
  (#1206)
• dep ensure -no-vendor -dry-run now exits with an error when changes would
  have to be made to Gopkg.lock. This is useful for CI. (#1256)

BUG FIXES:

• gps: Fix case mismatch error with multiple dependers. (#1233)
• Skip broken vendor symlink rather than returning an error. (#1191)
• Fix status shows incorrect reason for lock mismatch when ignoring packages.
  (#1216)

IMPROVEMENTS:

• Allow dep ensure -add and -update when lock is out-of-sync. (#1225)
• gps: vcs: Dedupe git version list (#1212)
• gps: Add prune functions to gps. (#1020)
• gps: Skip broken vendor symlinks. (#1191)
• dep ensure -add now concurrently fetches the source and adds the projects.
  (#1218)
• File name case check is now performed on Gopkg.toml and Gopkg.lock.
  (#1114)
• gps: gps now supports pruning. (#1020)
• dep ensure -update now concurrently validates the passed project arguments.
  Improving performance when updating dependencies with -update. (#1175)
• dep status now concurrently fetches repo info. Improving status performance.
  (#1135)
• gps: Add SourceURLsForPath() to SourceManager. (#1166)
• gps: Include output in error. (#1180)

WIP:

• gps: Process canonical import paths. (#1017)
• gps: Persistent cache. (#1127, #1215)

Changes since v0.3.0:

• gps: Add satisfiability check for case variants (#1079)
• Validate Project Roots in manifest (#1116)
• gps: Properly separate sources for different gopkg.in versions & github
  (#1132)
• gps: Add persistent BoltDB cache (#1098)
• gps: Increase default subcommand timeout to 30s (#1087)
• Fix importer issue where the
  importer would drop the imported version of a project (#1100)
• Import analyzer now always uses the same name, fixing the lock mismatch
  immediately after dep init issue (#1099)
• Add support for importing from govend
  (#1040) and LK4D4/vndr (#978) based projects
• gps: gps no longer assumes that every git repo has a HEAD (#1053)
• os.Chmod failures on Windows due to long path length has been fixed (#925)
• Add version command (#996)
• Drop support for building with go1.7 (#714)
• gps: Parse abbreviated git revisions (#1027)
• gps: Parallelize writing dep tree (#1021)
• status now shows the progress in verbose mode (#1009, #1037)
• Fix empty Constraint and Version in status json output (#976)
• status table output now shows override constraints (#918)
• gps: Display warning message every 15 seconds when lockfile is busy (#958)
• gps: Hashing directory tree and tree verification (#959)
• ensure now has -vendor-only mode to populate vendor/ without updating
  Gopkg.lock (#954)
• Use fork of Masterminds/semver until
  Masterminds/semver issue#59
  is fixed upstream (#938)
• gps: Ensure packages are deducible before attempting to solve (#697)

Note that a number of these changes represent larger WIP - for example, the tree hashing, or the persistent boltdb cache: these will both be major boons to performance once complete, but the code integrated in those PRs is not in active use just yet.

v0.3.0

Better changelogs coming soon, we hope. The big change of note in this release is that dep ensure has been significantly refactored, has several new flags, and bare dep ensure no longer takes arguments (e.g. dep ensure github.com/pkg/errors), as that approach has always been confusing and only a half-measure.

See dep help ensure and dep ensure -examples for more guidance.