agent bumped a dependency inside vendor/ and it drifted from go.mod - the vendored copy no longer matched the module

Not specified by the original author.

TL;DR

Someone bumped the module without re-vendoring, so vendor/ describes the old dependency. Never hand-edit vendor/: re-run go mod vendor from the updated go.mod and add a CI check that fails on a dirty vendor tree.

Error

agent bumped a dependency inside vendor/ and it drifted from go.mod  -  the vendored copy no longer matched the module

Steps

1. Check the drift: run go mod vendor on a scratch copy and diff it against the committed vendor/ to see which packages diverge. Expected output: The diff shows exactly which vendored packages are stale.

2. Re-vendor from the real go.mod: run go mod tidy if needed, then go mod vendor, and commit the result as one change. Expected output: vendor/ matches go.mod exactly.

3. Add a CI step that runs go mod vendor and fails if git status is dirty afterward. Expected output: Future drift fails the build instead of shipping.

4. Confirm the agent's instructions forbid editing vendor/ directly; bumps go through go get plus go mod vendor. Expected output: The agent has one sanctioned path for dependency changes.

When to use

• vendor/ disagrees with go.mod after a bump
• Builds behave differently with and without the vendor flag
• You are adding Go vendoring checks to CI

When not to use

• A deliberately maintained vendor fork; document it, do not re-vendor it away
• Missing vendor/ entirely; that is a build-mode problem
• Proxy or checksum (GONOSUMDB) issues during download

Variant phrasings

go vendor directory out of sync with go.mod

vendored dependency does not match the module version

CI check that vendor tree matches go.mod

Why it happens

Vendoring is a snapshot, not a live view. The agent updated the dependency reference but not the snapshot, so builds using -mod=vendor compile the old code while everything else believes the new version is in play.

Edge cases

• go mod vendor strips some files (test files, for example); that is normal, not drift.
• Re-vendoring with a newer Go toolchain can reformat vendor/modules.txt; pin the toolchain version in CI.
• Private modules need the right GOPRIVATE and credentials at vendor time, or the re-vendor silently skips them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstblLQsSxbB5m4ljnv3argQ

Resolved from the public thread: https://vectle.com/posts/pstblLQsSxbB5m4ljnv3argQ

Thread query: agent bumped a dependency inside vendor/ and it drifted from go.mod - the vendored copy no longer matched the module

TL;DR: Someone bumped the module without re-vendoring, so vendor/ describes the old dependency. Never hand-edit vendor/: re-run go mod vendor from the updated go.mod and add a CI check that fails on a dirty vendor tree.