Go modules
Shares rank 24 of 35 package managers by recommenders
People recommend Go modules for reproducible dependency resolution built into the toolchain and for removing name squatting; critics say tooling is rough and go mod tidy can update dependencies unexpectedly.
People recommend Go modules for reproducible dependency resolution built into the toolchain and for removing name squatting; critics say tooling is rough and go mod tidy can update dependencies unexpectedly.
16 people gave an opinion
- recommend it
- 10
- criticize it
- 6
- approval share
- 63%
Recommended in 8 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 10 people recommend itNeeds 10 or more, met.
- 1.6 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 8 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Safe, reproducible dependency fetching by default
“Go also has the kind of nice property that fetching and building modules is supposed to be safe with untrusted code.”
Comment from 6 Jul 2026 in “Dependencies should be fetched directly from VCS” “Go modules also offer hermetic and reproducible dependency resolution by default.”
Comment from 8 Jan 2026 in “go.sum Is Not a Lockfile” Simple, no extra tools needed
“There are no extra dependencies to grab your project dependencies and build it.”
Comment from 24 Jun 2026 in “Swift Package Index Joins Apple” “I definitely found cargo and go mod to be a lot simpler to get started with”
Comment from 1 Apr 2026 in “Show HN: CLI to order groceries via reverse-engineered REWE API (Haskell)”
What people warn about
Each mark is one comment
Brittle, hard-to-use tooling
“I haven't seen much improvement in off-happy-path tooling issues like that one to be too hopeful”
Comment from 11 Apr 2026 in “Supply chain nightmare: How Rust will be attacked and what we can do to mitigate” “it's a complete nightmare to work with”
Comment from 10 Apr 2026 in “Supply chain nightmare: How Rust will be attacked and what we can do to mitigate” “It’s half arsed, brittle and far from user friendly.”
Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload” Unexpected updates and no version pinning
“go mod tidy will update your go modules whenever it feels it needs to and there's nothing you can do to stop it.”
Comment from 25 May 2026 in “Migrating from Go to Rust” “we cannot "pin" versions (a personal bugbear of mine)”
Comment from 24 May 2026 in “Migrating from Go to Rust” Trusts dependencies to be well-behaved
“Go modules relies too heavily on dependencies being good citizens, which is a very naive approach to dependency management.”
Comment from 8 Jan 2026 in “go.sum Is Not a Lockfile” “go can download and run unverified code”
Comment from 8 Jan 2026 in “go.sum Is Not a Lockfile”
Other package managers people recommend
The four most recommended other package managers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 35 package managers, rankedWhat people said
All 19 comments that mention it, newest first. Each links to the original comment.
“it is design wart that such workarounds are required in first place”
“One thing it does get right, in my opinion, is removing the value of name squatting.”
“It’s half arsed, brittle and far from user friendly.”
“Go also has the kind of nice property that fetching and building modules is supposed to be safe with untrusted code.”
“There are no extra dependencies to grab your project dependencies and build it.”
“go mod tidy will update your go modules whenever it feels it needs to and there's nothing you can do to stop it.”
“we cannot "pin" versions (a personal bugbear of mine)”
“I'm honestly surprised that something as decentralized as Go Modules is more reliable”
“I haven't seen much improvement in off-happy-path tooling issues like that one to be too hopeful”
“it's a complete nightmare to work with”
“I definitely found cargo and go mod to be a lot simpler to get started with”
“Go's MVS algo can be considered much better for dependency management”
“Why do you think everyone uses PyPI, Cargo, Go modules, NPM”
“What doesn't make sense, is creating a completely new language/framework/package manager and decide to place the package registry burden on someone else.”
“Google also bullied the community into their own solution”
“Go modules also offer hermetic and reproducible dependency resolution by default.”
“Go modules relies too heavily on dependencies being good citizens, which is a very naive approach to dependency management.”
“go can download and run unverified code”
“Mostly for the better, but not quite always / not in all ways.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.