go-dependency-audit

To audit Go module dependencies for known vulnerabilities, run govulncheck against your project's go.mod and go.sum to surface only CVEs that affect your code paths, and use complementary scanners to detect transitive vulnerabilities.

Finding unused or stale packages in a Go project involves analyzing your go.mod file to detect unused modules, identify redundant dependencies, and list available updates to evaluate overall module hygiene and version drift.

Yes, you can check for transitive CVEs and committed replace directives during a Go dependency audit by analyzing transitive dependency graphs and enforcing go mod tidy to verify checksums and ensure proper module hygiene.

Integrating Go vulnerability scanning into CI pipelines involves running govulncheck and dependency hygiene checks on go.mod and go.sum during CI runs to automatically block commits containing stale, unused, or vulnerable dependencies.

Yes, this Go dependency audit works for evaluating third-party libraries before inclusion by analyzing module version updates, assessing dependency quality, and detecting transitive vulnerabilities to help teams make safe integration decisions.

A limitation of using govulncheck for Go module hygiene checks is that it primarily detects vulnerabilities affecting code paths, meaning you still need additional steps like go mod tidy and version drift analysis to catch unused modules and replace directives.