I've never had to use -mod=vendor, so I just looked it up: -mod mode module download mode to use: readonly, vendor, or mod.

I've never had to use -mod=vendor, so I just looked it up: -mod mode module download mode to use: readonly, vendor, or mod. By default, if a vendor directory is present and the go version in go.mod is 1.14 or higher, the go command acts as if -mod=vendor were set. Otherwise, the go command acts as if -mod=readonly were set. See https://golang.org/ref/mod#build-commands for details. If there's a vendor directory, it's used by default. As for my two cents, I use it frequently when building Docker images so that I don't have to pass secrets into the image to clone private modules (but I don't check the vendor directory into Git).