Go Dependency Management

This hasn't been a thing in Go for a long time. Go dep and now go modules fix this.

What is the current recommendation for dependency management in Go for a new project?

Is go package management still an unsolved problem then?

I've created a couple of projects in Go so far (a map server, similar to TileStache etc.) - Sure, the lack of generics is annoying, but I think the real elephant in the room is dependency and package management. The way Go expects you to organize your source code (the workspace concept, GOPATH, go get and github-repos as import paths) is a huge road block here. To this day the Go community hasn't settled on any kind of solution. If you bring any of this up on the mailing list you'

Several reasons:1. Finding dependencies with tooling now requires parsing code. Luckily Go's syntax is relatively simple and doesn't have conditional includes like C++ does but it'd be better if you could simply inspect a depedency configuration;2. You're directly importing potentially untrusted code that will often be of the form "github.io/someuser/reponame" so you now have a depedency on some random user's security practices or even just whim

The go team recognise there's a fundamental problem with it, otherwise they wouldn't have created dep and vgo [1][1] https://github.com/golang/go/issues/24301

This hasn't been the case since go modules exist, if I understand your issue correctly: https://go.dev/blog/using-go-modules. You can additionally vendor each project's dependencies

no have no idea what you're talking about. these problems don't exist anymore since godep and now go modules which is builtin to standard go tooling.

npm is just another layer on top of git. go uses git directly. how is that any worse?

Go doesn't really have a package manager (and that's a problem), it pulls the sources of the dependencies from github for example. There are multiple tools [1] to manage versioning, but Google only released recently (end of january) an official tool, still in beta.[1] https://github.com/golang/go/wiki/PackageManagementTools