What problem does it solve? Go projects accumulate dependency risk over time: stale go.mod files, uncommitted go.sum checksums, known CVEs in the tree, and version conflicts that are hard to diagnose. This Skill provides a disciplined workflow for adding, upgrading, auditing, and resolving Go module dependencies so the dependency tree stays honest and secure. ## Core Features & Use Cases - Deliberate dependency management: Confirm before adding new dependencies, pin versions explicitly, prefer patch-only upgrades with go get -u=patch ./..., and pin tools via a tools.go file. - Module hygiene and auditing: Keep go.mod and go.sum tidy and committed, vendor for hermetic builds, and run govulncheck ./... before every release to catch reachable CVEs. - Conflict resolution and deep dives: Diagnose conflicts with go mod graph and go mod why, resolve them with replace/exclude/retract, and consult references on MVS, workspaces, automated updates (Dependabot/Renovate), and graph visualization. - Use Case: Before releasing a Go service, run govulncheck on the tree, review outdated direct dependencies with go-mod-outdated, analyze binary bloat with goweight, and tidy the module before committing. ## Quick Start Ask the assistant to audit your Go project's dependencies, check for vulnerabilities with govulncheck, and safely upgrade all dependencies to their latest patch versions.
