How does vendoring work in module mode, and when is it still worth using?

go mod vendor copies the packages needed to build and test the main module into vendor/ and writes vendor/modules.txt. Since Go 1.14, if vendor/ exists and go.mod says go 1.14 or later, the go command defaults to -mod=vendor. It then builds only from vendor and checks that modules.txt is consistent with go.mod.

go mod vendor
go build ./...            # uses vendor/ automatically
go build -mod=mod ./...   # ignore vendor, use module cache
go work vendor            # Go 1.22+: vendor for a whole workspace

When it is worth it: hermetic or air-gapped builds (Bazel, corporate CI with no network), auditing third-party code in code review, and protection against upstream repos disappearing (a proxy also helps with that).

Downsides: large diffs, and it is easy to forget re-vendoring after go get (you get an "inconsistent vendoring" error). Only packages are copied, not whole modules, so non-Go files outside those packages are missing. Test files of dependencies are not vendored either. Most teams now use a module proxy (Athens, Artifactory) plus go.sum instead.