doc: remove mentions of dep; mention go mod

Signed-off-by: Chris Koch <chrisko@google.com>

CONTRIBUTING.md

@@ -87,8 +87,10 @@ Fork the project on GitHub, work in your fork and in branches, push
 these to your GitHub fork, and when ready, do a GitHub pull requests
 against https://github.com/u-root/u-root.
 
-`u-root` uses [dep](https://github.com/golang/dep)
-for its dependency management. Please run `dep ensure`, `dep prune`, and commit Gopkg.toml, Gopkg.lock and vendor/ changes before opening a pull request.
+u-root uses Go modules for its dependency management, but still vendors
+dependencies in the repository pending module support in the build system.
+Please run `go mod tidy` and `go mod vendor` and commit `go.mod`, `go.sum`, and
+`vendor/` changes before opening a pull request.
 
 Every commit in your pull request needs to be able to build and pass the CI tests.
 

README.md

@@ -29,6 +29,8 @@ u-root embodies four different projects.
 # Usage
 
 Make sure your Go version is 1.13. Make sure your `GOPATH` is set up correctly.
+While u-root uses Go modules, it still vendors dependencies and builds with
+`GO111MODULE=off`.
 
 Download and install u-root:
 
@@ -377,9 +379,9 @@ u-root can create an initramfs in two different modes:
 ## Updating Dependencies
 
 ```shell
-# The latest released version of dep is required:
-curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
-dep ensure
+go get -u
+go mod tidy
+go mod vendor
 ```
 
 # Hardware