# Depend on a module

```yaml
# buf.yaml
version: v2
deps:
  - protos.rip/<scope>/<module>
```

```bash
buf dep update  # resolve to the latest commit and write buf.lock
```

Pin to a label or commit by appending `:label` or `:<commit_id>` to the dep entry.

## Add the dep

Open the `buf.yaml` in your project — the one alongside your `.proto` files, not the module you’re publishing. Add the entry under the top-level `deps` key in the form `protos.rip/<scope>/<module>`:

```yaml
version: v2
deps:
  - protos.rip/<scope>/<module>
```

Repeat the entry for each protos.rip module you want to consume. Order in the file doesn’t affect resolution.

## Resolve with buf dep update

Run `buf dep update` from the directory containing `buf.yaml`:

```bash
buf dep update
```

The CLI contacts protos.rip, fetches the latest commit on the dep’s default label, and writes a `buf.lock` alongside `buf.yaml` that pins the resolved commit IDs. Check `buf.lock` into source control so collaborators and CI use the same commits. Re-run `buf dep update` whenever you want the latest commits — it rewrites `buf.lock` to whatever the labels now point at.

## Pin to a label or commit

Append `:<label>` to the dep entry to pin to whatever the label currently points at — `buf.lock` still records the resolved commit but follows the label on the next update. Append `:<commit_id>` to pin permanently to a specific commit, useful when you want a release to never move.

```yaml
version: v2
deps:
  - protos.rip/<scope>/<module>:v1.0.0
  - protos.rip/<scope>/<module>:01HXYZ...
```

The default label for a module is `main` unless changed in the dashboard.

## Mirrored modules

protos.rip mirrors a curated set of widely-used proto modules so you can pull them from one registry instead of stitching together GitHub paths. The mirror set lives at [/registry](/registry) and includes googleapis, protovalidate, protoc-gen-validate, grpc-gateway, and the well-known types. Depend on a mirror the same way as any other module — `protos.rip/<curated-scope>/<module>` under `deps`.

Mirrors update on the cadence the source repo publishes new tags or commits — see the registry page for the latest commit each one is at.

## See also

← Create a scope Labels and commits →