Note: this roadmap is quite out of date, and with the announcement of vgo, there are new externalities to consider. We're trying to this doc updated, but there's a lot of moving parts to be planned around first. We hope to update it by May, 2018. In the meantime, be assured that dep will be around until it no longer needs to be, and that we'll continue to work to improve it.

The goal with dep is to be absorbed into the go toolchain. That's the path we're on, but it's up to the Go community - you! - to help us see it through.

The roadmap has three basic phases:

• First, we need to get dep in shape so that it's ready to be merged into the toolchain. Ideally, this would happen at the very beginning of a Go development cycle, to provide the most time for acclimation and tire-kicking.
• Second, once it's merged, we need to finish just the essential features, update other parts of the toolchain accordingly, and generally ensure it's solid and polished by the time of the next Go release.
• The third, "future" phase is all about changes (e.g. fixing GOPATH) we can make once the tool is well-established in the ecosystem.

Our goal is that phase 1 will be wrapped by the end of the 1.9 cycle, and dep will be merged into the toolchain when 1.10 development begins.

We've created a bunch of epic issues that we believe capture the work that needs doing for each phase:

• Pre-merge phase (1.9 cycle, thru mid 2017):
  • Stable manifest and lock files - dep can be used "for real" once the manifest and lock files are stabilized. Once this point is reached, it should be OK to use dep as your primary tool.
  • Stable command set - all dep commands specced, defined, and implemented.
  • Security model - security needs to come off the backburner, now.
• Pre-toolchain release phase (1.10 cycle, thru end 2017)
  • OS/Arch and build tags - cross-compilability by default is crucial.
  • Errors and failures - making dep's failure modes comprehensible for everyone.
  • Private/Enterprise patterns support - official tooling really needs to serve both the public and private use cases.
  • Improved performance - dep is slow right now, but there's clear paths to fixing that.
  • cgo support - we've ignored cgo so far, but that can't continue.
• Future phase (2018 and on):
  • Once dep is absorbed into the toolchain, transforming GOPATH becomes possible; this proto-proposal is one form that might take.

Please remember that finishing these issues does not guarantee dep will be accepted. No external code of this size or significance has ever been pulled into the Go toolchain before, so everyone's kind of playing it by ear.

We plan to keep this roadmap updated as things evolve.

A lot of work lies ahead, but the momentum since we opened up dep has been tremendous - there's every reason to believe we can pull it off! Right now, we NEED PEOPLE to help shoulder the workload of writing docs, writing code, clarifying some design issues, and kicking the tires. Also, if anyone's interested in helping out with some project management, that would be huge 😄

If you're interested in contributing, here's some ways to go about finding your way in:

• Install dep (go get -u github.com/golang/dep/cmd/dep), try it out on one of your projects, and get a feel for it.
• Look through the epic issues linked above, and follow them down into the issues they link to.
• Join #vendor channel in the Gophers slack to ask questions. We're nice, and there are no stupid questions!
• If it seems like something's missing from our plan, open an issue!