golang-dependency-management

To safely upgrade Go module dependencies, run govulncheck to catch reachable vulnerabilities, use go get for targeted upgrades including patch-only bumps, and run go mod tidy to keep go.mod honest. Resolve any version conflicts across the dependency graph before releasing.

govulncheck identifies actually-called vulnerabilities by analyzing your Go project's dependency graph and call stack, distinguishing vulnerabilities in code your application actually reaches from unused library code to prioritize real risks before release.

Yes, committing go.sum and running go mod verify confirms checksums for hermetic Go builds. This ensures dependency integrity and repeatable resolution across different environments, with optional vendoring for strict build isolation.

The best way to resolve version conflicts in a Go dependency graph is following the Minimal Version Selection (MVS) algorithm, using replace, exclude, or retract directives with correct intent, and running go mod tidy after changes to ensure honest go.mod state.

Use go.work workspaces for multi-module Go development when working across multiple interdependent modules simultaneously, handling go.work.sum appropriately to maintain consistent dependency resolution across the workspace.

go mod tidy modifies your go.mod file to maintain an honest representation of required dependencies, removing unused modules and adding missing ones, which is the recommended workflow after any dependency addition, upgrade, or removal to ensure reproducible builds.