golang-dependency-management

To safely upgrade Go module dependencies, apply patch-only updates with `go get -u=patch`, run `go mod tidy` to sync go.sum, and validate changes using `go test`, `go vet`, and `govulncheck` for call-path-aware vulnerability detection before committing.

`govulncheck` is a call-path-aware vulnerability scanner for Go projects that analyzes your code's actual dependency usage to identify security regressions, ensuring only reachable vulnerabilities are flagged during dependency upgrades or removals.

Resolve version conflicts in go.mod by leveraging Go's Minimal Version Selection (MVS) and strategically applying `replace` or `exclude` directives to override incompatible modules, ensuring binary size and dependency graph consistency are maintained.

Yes, you must commit the `go.sum` file to ensure dependency reproducibility and integrity, complementing it with `go mod verify` and vendoring practices when needed to prevent maintenance debt and unsafe upgrades.

Automate Go dependency updates by configuring Dependabot or Renovate to generate pull requests, enforcing verification gates that automatically run `govulncheck ./...` and `go test` to prevent security regressions before merging.

`go mod tidy` modifies go.sum to add missing checksums and remove unused entries, resolving integrity issues by synchronizing the file with your actual module requirements and ensuring deterministic builds across environments.