{"record":{"id":"1fbf8afc2cc69b41","repo":"golang/go","slug":"use-of-vendored-package-not-allowed","errorCode":null,"errorMessage":"use of vendored package not allowed","messagePattern":"use of vendored package not allowed","errorType":"validation","errorClass":"PackageError","httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/load/pkg.go","lineNumber":1668,"sourceCode":"\t\treturn nil\n\t}\n\tparent := p.Dir[:truncateTo]\n\tif str.HasFilePathPrefix(filepath.Clean(srcDir), filepath.Clean(parent)) {\n\t\treturn nil\n\t}\n\n\t// Look for symlinks before reporting error.\n\tsrcDir = expandPath(srcDir)\n\tparent = expandPath(parent)\n\tif str.HasFilePathPrefix(filepath.Clean(srcDir), filepath.Clean(parent)) {\n\t\treturn nil\n\t}\n\n\t// Vendor is present, and srcDir is outside parent's tree. Not allowed.\n\n\tperr := &PackageError{\n\t\tImportStack: stk.Copy(),\n\t\tErr:         errors.New(\"use of vendored package not allowed\"),\n\t}\n\treturn perr\n}\n\n// FindVendor looks for the last non-terminating \"vendor\" path element in the given import path.\n// If there isn't one, FindVendor returns ok=false.\n// Otherwise, FindVendor returns ok=true and the index of the \"vendor\".\n//\n// Note that terminating \"vendor\" elements don't count: \"x/vendor\" is its own package,\n// not the vendored copy of an import \"\" (the empty import path).\n// This will allow people to have packages or commands named vendor.\n// This may help reduce breakage, or it may just be confusing. We'll see.\nfunc FindVendor(path string) (index int, ok bool) {\n\t// Two cases, depending on internal at start of string or not.\n\t// The order matters: we must return the index of the final element,\n\t// because the final one is where the effective import path starts.\n\tswitch {\n\tcase strings.Contains(path, \"/vendor/\"):","sourceCodeStart":1650,"sourceCodeEnd":1686,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/load/pkg.go#L1650-L1686","documentation":"When a vendor/ directory exists, vendored packages may only be imported by source files that live within the same tree rooted at the vendor's parent. checkVendor computes srcDir and parent; if srcDir is not under parent (after symlink expansion), the import is rejected as an unauthorized use of a vendored copy.","triggerScenarios":"An import path resolves to a directory under a vendor/ folder, but the importing source file's directory (srcDir) is outside the module root that owns that vendor directory.","commonSituations":"Mixing GOPATH-style vendoring with module mode; importing a vendored package from a sibling module or from the command-line-arguments pseudo-package; tooling invoked from a different working directory than the module root.","solutions":["Move the importing source files inside the module that contains the vendor directory.","Switch to module mode (GO111MODULE=on) and let go.mod requirements resolve dependencies instead of vendor.","Remove the vendor directory and rely on the module graph, then re-vendor with `go mod vendor` once the layout is correct."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before building, ensure the importing file is under the module root\n// that owns vendor/. Equivalently: never import across module roots\n// through a vendor/ path. Prefer module mode and let go.mod resolve it.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep all importing source files within the module root that contains vendor/.","Prefer module-mode dependency resolution over manual vendoring.","Do not run the go command from a sibling module expecting to use another's vendor tree."],"tags":["go","vendor","modules","build"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}