diff --git a/go.mod b/go.mod
index 16e9a0c81b0..b8817a43260 100644
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@
 
 module k8s.io/kubernetes
 
-go 1.16
+go 1.18
 
 require (
 	bitbucket.org/bertimus9/systemstat v0.0.0-20180207000608-0eeff89b0690
diff --git a/hack/tools/go.mod b/hack/tools/go.mod
index 8e60bc1ebc9..f4a529ed64b 100644
--- a/hack/tools/go.mod
+++ b/hack/tools/go.mod
@@ -1,6 +1,6 @@
 module k8s.io/kubernetes/hack/tools
 
-go 1.16
+go 1.18
 
 require (
 	github.com/aojea/sloppy-netparser v0.0.0-20210819225411-1b3bd8b3b975
diff --git a/hack/update-vendor-licenses.sh b/hack/update-vendor-licenses.sh
index 236f5851fee..fcbcf982877 100755
--- a/hack/update-vendor-licenses.sh
+++ b/hack/update-vendor-licenses.sh
@@ -186,8 +186,10 @@ if [ -f "${LICENSE_ROOT}/LICENSE" ]; then
   mv "${TMP_LICENSE_FILE}" "${TMP_LICENSES_DIR}/LICENSE"
 fi
 
+# Capture all module dependencies
+modules=$(go list -m -json all | jq -r .Path | sort -f)
 # Loop through every vendored package
-for PACKAGE in $(go list -m -json all | jq -r .Path | sort -f); do
+for PACKAGE in ${modules}; do
   if [[ -e "staging/src/${PACKAGE}" ]]; then
     echo "${PACKAGE} is a staging package, skipping" >&2
     continue
@@ -196,26 +198,16 @@ for PACKAGE in $(go list -m -json all | jq -r .Path | sort -f); do
     echo "${PACKAGE} doesn't exist in ${DEPS_DIR}, skipping" >&2
     continue
   fi
-  # Skip a directory if 1) it has no files and 2) all the subdirectories contain a go.mod file.
-  misses_go_mod=false
-  DEPS_SUBDIR="${DEPS_DIR}/${PACKAGE}"
-  search_for_mods () {
-    if [[ -z "$(find "${DEPS_SUBDIR}/" -mindepth 1 -maxdepth 1 -type f)" ]]; then
-      while read -d "" -r SUBDIR; do
-          if [[ ! -e "${SUBDIR}/go.mod" ]]; then
-              DEPS_SUBDIR=${SUBDIR}
-              search_for_mods
-          fi
-      done < <(find "${DEPS_SUBDIR}/" -mindepth 1 -maxdepth 1 -type d -print0)
-    else
-      misses_go_mod=true
-    fi
-  }
-  search_for_mods
-  if [[ $misses_go_mod = false ]]; then
-      echo "${PACKAGE} has no files, skipping" >&2
+
+  # if there are no files vendored under this package...
+  if [[ -z "$(find "${DEPS_DIR}/${PACKAGE}" -mindepth 1 -maxdepth 1 -type f)" ]]; then
+    # and we have the same number of submodules as subdirectories...
+    if [[ "$(find "${DEPS_DIR}/${PACKAGE}/" -mindepth 1 -maxdepth 1 -type d | wc -l)" -eq "$(echo "${modules}" | grep -cE "^${PACKAGE}/")" ]]; then
+      echo "Only submodules of ${PACKAGE} are vendored, skipping" >&2
       continue
+    fi
   fi
+
   echo "${PACKAGE}"
 
   process_content "${PACKAGE}" LICENSE
diff --git a/hack/update-vendor.sh b/hack/update-vendor.sh
index ccd20efb965..382772fa201 100755
--- a/hack/update-vendor.sh
+++ b/hack/update-vendor.sh
@@ -114,13 +114,21 @@ function ensure_require_replace_directives_for_all_dependencies() {
       | xargs -L 100 go mod edit -fmt
 }
 
-function group_replace_directives() {
+function group_directives() {
   local local_tmp_dir
   local_tmp_dir=$(mktemp -d "${TMP_DIR}/group_replace.XXXX")
+  local go_mod_require_direct="${local_tmp_dir}/go.mod.require_direct.tmp"
+  local go_mod_require_indirect="${local_tmp_dir}/go.mod.require_indirect.tmp"
   local go_mod_replace="${local_tmp_dir}/go.mod.replace.tmp"
-  local go_mod_noreplace="${local_tmp_dir}/go.mod.noreplace.tmp"
+  local go_mod_other="${local_tmp_dir}/go.mod.other.tmp"
   # separate replace and non-replace directives
   awk "
+     # print lines between 'require (' ... ')' lines
+     /^require [(]/          { inrequire=1; next                            }
+     inrequire && /^[)]/     { inrequire=0; next                            }
+     inrequire && /\/\/ indirect/ { print > \"${go_mod_require_indirect}\"; next }
+     inrequire               { print > \"${go_mod_require_direct}\";   next }
+
      # print lines between 'replace (' ... ')' lines
      /^replace [(]/      { inreplace=1; next                   }
      inreplace && /^[)]/ { inreplace=0; next                   }
@@ -129,11 +137,21 @@ function group_replace_directives() {
      # print ungrouped replace directives with the replace directive trimmed
      /^replace [^(]/ { sub(/^replace /,\"\"); print > \"${go_mod_replace}\"; next }
 
-     # otherwise print to the noreplace file
-     { print > \"${go_mod_noreplace}\" }
+     # print ungrouped require directives with the require directive trimmed
+     /^require [^(].*\/\/ indirect/ { sub(/^require /,\"\"); print > \"${go_mod_require_indirect}\"; next }
+     /^require [^(]/ { sub(/^require /,\"\"); print > \"${go_mod_require_direct}\"; next }
+
+     # otherwise print to the other file
+     { print > \"${go_mod_other}\" }
   " < go.mod
   {
-    cat "${go_mod_noreplace}";
+    cat "${go_mod_other}";
+    echo "require (";
+    cat "${go_mod_require_direct}";
+    echo ")";
+    echo "require (";
+    cat "${go_mod_require_indirect}";
+    echo ")";
     echo "replace (";
     cat "${go_mod_replace}";
     echo ")";
@@ -215,8 +233,8 @@ ensure_require_replace_directives_for_all_dependencies
 go mod tidy >>"${LOG_FILE}" 2>&1
 # pin expanded versions
 ensure_require_replace_directives_for_all_dependencies
-# group replace directives
-group_replace_directives
+# group require/replace directives
+group_directives
 
 # Phase 4: copy root go.mod to staging dirs and rewrite
 
@@ -332,6 +350,9 @@ $(go mod why "${loopback_deps[@]}")"
              "-dropreplace \(.Replace.Path)"' |
     xargs -L 100 go mod edit -fmt
 
+    # group require/replace directives
+    group_directives
+
   popd >/dev/null 2>&1
 done
 echo "=== tidying root" >> "${LOG_FILE}"
diff --git a/hack/verify-no-vendor-cycles.sh b/hack/verify-no-vendor-cycles.sh
index c68cff3a3f3..0d83a29ef50 100755
--- a/hack/verify-no-vendor-cycles.sh
+++ b/hack/verify-no-vendor-cycles.sh
@@ -25,7 +25,7 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-export GO111MODULE=auto
+export GO111MODULE=on
 
 staging_repos=()
 kube::util::read-array staging_repos < <(kube::util::list_staging_repos)
@@ -45,12 +45,18 @@ kube::util::ensure-temp-dir
 
 # Get vendored packages dependencies
 # Use -deps flag to include transitive dependencies
-go list -mod=vendor -test -deps -json ./vendor/... > "${KUBE_TEMP}/deps.json"
+go list -mod=vendor -test -tags other   -e -deps -json ./vendor/... > "${KUBE_TEMP}/deps_other.json"
+go list -mod=vendor -test -tags linux   -e -deps -json ./vendor/... > "${KUBE_TEMP}/deps_linux.json"
+go list -mod=vendor -test -tags windows -e -deps -json ./vendor/... > "${KUBE_TEMP}/deps_windows.json"
 
 # Check for any vendored package that imports main repo
 # Staging repos are explicitly excluded even though go list does not currently consider symlinks
-go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/kubernetes/" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps.json"
+go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/kubernetes/" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps_other.json"
+go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/kubernetes/" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps_linux.json"
+go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/kubernetes/" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps_windows.json"
 
 # Check for any vendored package that imports a staging repo
 # Staging repos are explicitly excluded even though go list does not currently consider symlinks
-go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/(${staging_repos_pattern})(/|$)" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps.json"
+go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/(${staging_repos_pattern})(/|$)" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps_other.json"
+go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/(${staging_repos_pattern})(/|$)" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps_linux.json"
+go run cmd/dependencycheck/dependencycheck.go -restrict "^k8s\.io/(${staging_repos_pattern})(/|$)" -exclude "^k8s\.io/(${staging_repos_pattern})(/|$)" "${KUBE_TEMP}/deps_windows.json"