docs updates

README.md

@@ -77,8 +77,9 @@ Dependencies will be automatically detected for
 2. [Bundler (rubygem)](./docs/sources/bundler.md)
 3. [Cabal](./docs/sources/cabal.md)
 4. [Go](./docs/sources/go.md)
-5. [Manifest lists](./docs/sources/manifests.md)
-6. [NPM](./docs/sources/npm.md)
+5. [Go Dep](./docs/sources/dep.md)
+6. [Manifest lists](./docs/sources/manifests.md)
+7. [NPM](./docs/sources/npm.md)
 
 You can disable any of them in the configuration file:
 

docs/sources/dep.md

@@ -0,0 +1,33 @@
+# Warning!
+This source is intended to be used when all of a projects dependencies have been vendored and does not detect non-vendored packages installed at `$GOPATH/pkg`.  If your project uses dependencies that are not listed in `Gopkg.lock`, then you must use the go source to enumerate all project dependencies.
+
+# Go Dep
+
+The dep source will detect dependencies when the source is enabled and both `Gopkg.toml` and `Gopkg.lock` are found at an apps `source_path`.  It
+parses the `Gopkg.lock` file to find packages that have been vendored into the project directory.
+
+This source will self-disable if the `ignored` property in `Gopkg.toml` has any values.  While strongly discouraged, the source can be forced to run
+via configuration.
+
+```yml
+dep:
+  allow_ignored: true # force source to run even if `Gopkg.toml` is non-empty
+```
+
+#### Limitations
+
+The dep dependency source has some limitations compared to the general-purpose go source.
+1. Go std libraries are not filtered from enumerated dependencies if `go list std` is not available
+2. Summary information is not available for packages
+
+#### Go or Dep
+
+Reasons to choose the dep source over the go source
+1. The dep source does not have a hard dependency on go being installed
+  - some functionality is only available if go is available
+    1. filtering go std libs from the found dependencies
+2. The dep source should generally run much more quickly then the go source
+
+Reasons to choose the go source over the dep source
+1. Your project has dependencies not specified by `Gopkpg.lock`
+2. You require dependency summary information