- Add or update a dependency with `go get <dependency>@<version>`.
- If you want to use a fork of a project or ensure that a dependency is not updated even when another dependency requires a newer version of it, manually add a [replace directive in the go.mod file](https://github.com/golang/go/wiki/Modules#when-should-i-use-the-replace-directive).
- Run `go mod tidy` to tidy `go.mod` and update `go.sum`, then commit the changes.
- Run `go mod vendor` to re-vendor and then commit updated vendored code separately.
If your vendor bump touched `github.com/openshift/api`, also run `go generate ./pkg/types/installconfig.go` to update [`data/data/install.openshift.io_installconfigs.yaml`](/data/data/install.openshift.io_installconfigs.yaml).