golang-dependency-management

Manages Go module dependencies including upgrades, vulnerability scanning, and conflict resolution.

Updated Jun 15, 2026

Search Tags:#dependency management #golang #semver #vulnerability scanning #go.mod #govulncheck #go modules

Ready to run

npx skills add https://github.com/2877389577/novels_ai_gen --skill golang-dependency-management-2877389577

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: golang-dependency-management
Source: https://github.com/2877389577/novels_ai_gen/tree/main/.agents/skills/golang-dependency-management
Command: npx skills add https://github.com/2877389577/novels_ai_gen --skill golang-dependency-management-2877389577

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, and includes references (resource) components.

What problem does it solve? Go projects accumulate dependencies that need safe upgrading, vulnerability auditing, and conflict resolution, and mistakes like gitignoring go.sum or misusing replace directives create supply-chain and reproducibility risks. ## Core Features & Use Cases - Safe Dependency Lifecycle: Add, upgrade (preferring `go get -u=patch`), and remove modules with mandatory user confirmation before adding new dependencies and stdlib-alternative evaluation. - Security & Auditing: Run govulncheck call-path analysis, track outdated modules with go-mod-outdated, and analyze binary size contributions with goweight or go-size-analyzer. - Versioning & Conflict Resolution: Apply Minimal Version Selection reasoning, major version suffix rules, and replace/exclude/retract directives correctly, plus go.work workspace management. - Use Case: Before a release, run `go get -u=patch ./...`, `go mod tidy`, `go test ./...`, and `govulncheck ./...` to ship updated dependencies without known CVEs. ## Quick Start Ask the agent to audit my Go project's dependencies for vulnerabilities and outdated packages, then propose safe patch-level upgrades.

Frequently Asked Questions about golang-dependency-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I safely upgrade all Go dependencies?▼

Run `go get -u=patch ./...` to upgrade only patch versions, which carry no API changes per semver, then run `go mod tidy`, `go test ./...`, and `govulncheck ./...`. Plain `go get -u ./...` also upgrades minor versions, which can change behavior.

Should go.sum be committed to git?▼

Yes, go.sum must always be committed. It records cryptographic checksums of every dependency version, letting `go mod verify` detect supply-chain tampering; without it, a compromised proxy could substitute malicious code.

How does Go select dependency versions with MVS?▼

Go uses Minimal Version Selection: it picks the highest minimum version required across the module graph, not the latest available like npm or pip. This gives deterministic builds without a lock file; go.sum is integrity verification only.

Do replace directives in go.mod affect library consumers?▼

No. Replace and exclude directives only take effect in the main module's go.mod and are ignored when your module is consumed as a dependency. Remove replace directives before publishing a library.

How do I pin CLI tool versions like golangci-lint in Go?▼

For Go 1.24+, use tool directives: run `go get -tool <package>@latest` to pin tools in go.mod, then execute them reproducibly with `go tool <name>`. Only use the legacy tools.go blank-import file for modules targeting Go below 1.24.

Does govulncheck flag vulnerabilities my code never calls?▼

No. govulncheck uses static analysis to trace call paths from your code to vulnerable functions, so it only reports vulnerabilities that are actually reachable, unlike generic CVE scanners that flag any flagged dependency's presence.