golang/go · error · PackageError

use of vendored package not allowed

Error message

use of vendored package not allowed

What it means

When a vendor/ directory exists, vendored packages may only be imported by source files that live within the same tree rooted at the vendor's parent. checkVendor computes srcDir and parent; if srcDir is not under parent (after symlink expansion), the import is rejected as an unauthorized use of a vendored copy.

Source

Thrown at src/cmd/go/internal/load/pkg.go:1668

		return nil
	}
	parent := p.Dir[:truncateTo]
	if str.HasFilePathPrefix(filepath.Clean(srcDir), filepath.Clean(parent)) {
		return nil
	}

	// Look for symlinks before reporting error.
	srcDir = expandPath(srcDir)
	parent = expandPath(parent)
	if str.HasFilePathPrefix(filepath.Clean(srcDir), filepath.Clean(parent)) {
		return nil
	}

	// Vendor is present, and srcDir is outside parent's tree. Not allowed.

	perr := &PackageError{
		ImportStack: stk.Copy(),
		Err:         errors.New("use of vendored package not allowed"),
	}
	return perr
}

// FindVendor looks for the last non-terminating "vendor" path element in the given import path.
// If there isn't one, FindVendor returns ok=false.
// Otherwise, FindVendor returns ok=true and the index of the "vendor".
//
// Note that terminating "vendor" elements don't count: "x/vendor" is its own package,
// not the vendored copy of an import "" (the empty import path).
// This will allow people to have packages or commands named vendor.
// This may help reduce breakage, or it may just be confusing. We'll see.
func FindVendor(path string) (index int, ok bool) {
	// Two cases, depending on internal at start of string or not.
	// The order matters: we must return the index of the final element,
	// because the final one is where the effective import path starts.
	switch {
	case strings.Contains(path, "/vendor/"):

View on GitHub (pinned to b6b368adc5)

Solutions

1. Move the importing source files inside the module that contains the vendor directory.
2. Switch to module mode (GO111MODULE=on) and let go.mod requirements resolve dependencies instead of vendor.
3. Remove the vendor directory and rely on the module graph, then re-vendor with `go mod vendor` once the layout is correct.

// Before building, ensure the importing file is under the module root
// that owns vendor/. Equivalently: never import across module roots
// through a vendor/ path. Prefer module mode and let go.mod resolve it.

When it happens

Trigger: An import path resolves to a directory under a vendor/ folder, but the importing source file's directory (srcDir) is outside the module root that owns that vendor directory.

Common situations: Mixing GOPATH-style vendoring with module mode; importing a vendored package from a sibling module or from the command-line-arguments pseudo-package; tooling invoked from a different working directory than the module root.

Related errors

• multiple //go:build comments
• can only use path@version syntax with 'go get' and 'go insta
• import cycle not allowed
• binary-only packages are no longer supported
• import cycle not allowed in test

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/1fbf8afc2cc69b41. Report an issue: GitHub.