Dep: Why does dep ensure not add packages to Gopkg.toml?

[firelizzard18]

I have a project. I ran dep init and got everything happy. I have a Gopkg.toml with a few things in it, and a Gopkg.lock with many things in it. And of course, a vendor folder. Now, I have added an import for github.com/gorilla/websocket, which is a new dependency for this project.

My understanding is that best practice is to include all direct dependencies in Gopkg.toml. However, dep status tells me to run dep ensure, but when I run dep ensure, the new dependency is not added to Gopkg.toml. Why?

Lock inputs-digest mismatch due to the following packages missing from the lock:

PROJECT                       MISSING PACKAGES
github.com/gorilla/websocket  [github.com/gorilla/websocket]

This happens when a new import is added. Run `dep ensure` to install the missing packages.
input-digest mismatch

[standielpls]

Also have this issue.
Also tried deleting the package in go/pkg/dep/sources/ too and it brings it in again, but not imported to my vendor file.

[sdboyer]

The answer isn't terribly satisfying - basically, "it's a TODO we haven't gotten to." It's unlikely we get around to fixing it in dep, as the successor tool to dep will have a different structure where we don't have this same problem.

[cequintana]

When is this going to be fixed?

[mvdan]

Dep was officially deprecated earlier this year, and the proposal to archive this repository was accepted. As such, I'm closing outstanding issues before archiving the repository. For any further comments, please use the proposal thread on the Go issue tracker. Thanks!