Of our 40 or so external dependencies (huge project), only a handful themselves have dependencies we needed to also vendor. Its sounds painful, but in practice

Of our 40 or so external dependencies (huge project), only a handful themselves have dependencies we needed to also vendor. Its sounds painful, but in practice it hasn't been. We actually stopped using godep, we were getting no reward for the hassle and added complexity. Unless there is a bug, or new feature we needed, we often just update this stuff when we update the Go release we are using. My thoughts; KISS until more complexity is actually needed.