So currently I am in a project where I successfully vended many dependencies and ran dep prune to eliminate unused packages under vendor/.

Now I am trying to add github.com/pkg/errors dependency, so I run:

dep ensure github.com/pkg/errors@^0.8.0

Once this command executes, all unused packages of my already saved dependencies come back, effectively undoing what dep prune did.

At this point I cannot execute "dep prune" anymore as it appears like the lock file is corrupted:

$ dep prune
lock hash doesn't match

At least it did vendor github.com/pkg/errors successfully but millions of lines of code I did not use came back, plus I can't run dep prune anymore. So I rm -rf Gopkg.* vendor/ and start over with dep init.