pkg.soopen package index

brew / rank 12644

Install git-vendor with Homebrew, Nix

Command for managing git vendored dependencies. Version 1.3.0 via Homebrew; verified from local package data. Also installable with nix: nix profile install nixpkgs#git-vendor.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install git-vendor

local Homebrew formula metadata

Linux

Nixverified · 92%
nix profile install nixpkgs#git-vendor

nixpkgs package indexes · pkgs/by-name/gi/git-vendor/package.nix · source: api.github.com

overview

Package summary

Command for managing git vendored dependencies

Commands and aliases

  • git-vendor

history

Project history and usage

git-vendor is a shell Git command that wraps git subtree to add, list, update, and share vendored dependencies.

Project history

Brett Langdon created the git-vendor repository in January 2016. The README explains that the tool follows the Go vendoring convention of storing dependencies under vendor/ using fully qualified project paths.

The project stayed close to git subtree. Later releases refined command behavior, including a 2022 release that added a push command through a community contribution.

Adoption history

git-vendor spread through source installation, Homebrew, and other package-manager formulas. Its adoption niche was teams that wanted vendored source checked into a repository without relying on language-specific package managers.

How it is used

Practitioners use git vendor add to import a repository at a ref, git vendor list to inspect recorded source metadata, git vendor update to move a vendored dependency forward, and git vendor upstream to share changes back.

Why package nerds care

The tool is significant in package-management history because it captures a pre-module and cross-language vendoring pattern: source is copied into the tree, but the Git history and vendor metadata preserve where that source came from.

Timeline

  • 2016: Repository created for a git subtree-based vendoring workflow.
  • 2021: v1.2.x releases refined update behavior and portability.
  • 2022: v1.3.0 added a push command.

Related projects

  • git subtree, Go vendor directories, Homebrew

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 1 platform targets.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
git-vendorcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-04
manager version1.3.0
manager updated
local dataok
upstreamcurrent
latest detectedv1.3.0

https://github.com/brettlangdon/git-vendor

  • infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package keybrew:git-vendor
Version1.3.0
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/git-vendor
Homepagehttps://brettlangdon.github.io/git-vendor
Repositoryhttps://github.com/brettlangdon/git-vendor
Upstream docshttps://brettlangdon.github.io/git-vendor
LicenseMIT
Source archivehttps://github.com/brettlangdon/git-vendor/archive/refs/tags/v1.3.0.tar.gz
Bottleavailable (on all)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namegit-vendor
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

git-vendor

nix profile install nixpkgs#git-vendor
  • normalized package name match
  • Matched by: Git Vendor
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/gi/git-vendor/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • git-machetePackage names and metadata indicate a similar tool family. Shared terms: cli, developer, developer-tools, extension, git.
  • git-url-subPackage names and metadata indicate a similar tool family. Shared terms: cli, developer, developer-tools, extension, git.

Same workflow

  • mavenShares pkgdb curated category or tags: cli, dependency-management, developer-tools.
  • git-lfsShares pkgdb curated category or tags: cli, developer-tools, git-extension.
  • gradleShares pkgdb curated category or tags: cli, dependency-management, developer-tools.
  • poetryShares pkgdb curated category or tags: cli, dependency-management, developer-tools.
  • pipenvShares pkgdb curated category or tags: cli, dependency-management, developer-tools.
  • swift-shShares pkgdb curated category or tags: cli, dependency-management, developer-tools.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment
  • pkg.so package database
  • pkgdb category and tag curation