skills.rest
titaneric
titanericCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

golang-dependency-management

Manages Go module dependencies including upgrades, vulnerability scanning, and conflict resolution.

1|Updated May 25, 2020
Search Tags:#versioning#dependency management#golang#vulnerability scanning#go.mod#govulncheck#go modules
One-click install
npx skills add https://github.com/titaneric/dotfiles --skill golang-dependency-management-titaneric
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-dependency-management
Source: https://github.com/titaneric/dotfiles/tree/main/dot_agents/skills/golang-dependency-management
Command: npx skills add https://github.com/titaneric/dotfiles --skill golang-dependency-management-titaneric

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires govulncheck, and includes references (resource) components.

What problem does it solve? Go projects accumulate dependencies that need safe upgrading, vulnerability auditing, and conflict resolution, and mistakes like gitignoring go.sum or blindly running go get -u introduce supply-chain and stability risks. ## Core Features & Use Cases - Safe Dependency Lifecycle: Add, upgrade (patch-first), and remove Go modules with go.mod/go.sum hygiene rules, including Go 1.24+ tool directives for pinning CLI tools like golangci-lint and govulncheck. - Auditing & Visualization: Scan for reachable vulnerabilities with govulncheck, track outdated modules with go-mod-outdated, and analyze binary size contributions with goweight or go-size-analyzer. - Conflict Resolution & Workspaces: Diagnose version conflicts with go mod graph, apply replace/exclude/retract directives correctly, and manage multi-module development with go.work files. - Use Case: Before a release, run govulncheck ./... to catch CVEs in called code paths, upgrade with go get -u=patch ./..., tidy the module, and verify tests pass. ## Quick Start Ask the agent to audit your Go project's dependencies for vulnerabilities and outdated packages, then propose a safe patch-level upgrade plan.

Frequently Asked Questions about golang-dependency-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely upgrade all Go dependencies?▼

Use go get -u=patch ./... for routine updates since patch versions carry no API changes per semver. Follow with go mod tidy, go test ./..., go vet ./..., and govulncheck ./... to verify the upgrade.

Should go.sum be committed to git?▼

Yes, go.sum must be committed. It records cryptographic checksums of every dependency version, letting go mod verify detect supply-chain tampering; without it a compromised proxy could substitute malicious code.

How does Go select dependency versions with MVS?▼

Go uses Minimal Version Selection: it picks the highest minimum version required across the module graph, not the latest available. This gives deterministic builds without a lock file, unlike npm or pip.

How do I pin golangci-lint and govulncheck versions in Go?▼

For Go 1.24+, use go get -tool to add tool directives in go.mod, then run them with go tool golangci-lint or go tool govulncheck. For Go below 1.24, use the legacy tools.go blank-import workaround.

What is the difference between replace, exclude, and retract in go.mod?▼

Replace substitutes a module version or path and only works in the main module. Exclude blocks a specific version of a dependency, redirecting to the next higher one. Retract is used by module authors to mark their own published versions as broken.

Should go.work.sum be committed to version control?▼

No, go.work.sum should not be committed; add it to .gitignore. Workspaces are for local development only and do not affect consumers of published modules, unlike go.sum which must be committed.

Related Skills

Explore More Software Engineering Skills→
GoogleCloudPlatformGoogleCloudPlatform
1.1k

update-client-library-version

Updates Google Cloud Go client libraries across Config Connector modules and validates fuzz tests.

Official
Intermediate
ozan-fnozan-fn

golang-dependency-management

Manage Go dependencies in go.mod and go.sum files with vulnerability scanning.

Community
Advanced
MolcajeteAIMolcajeteAI
2

security-scanning

Scan Go projects with gosec and govulncheck for security vulnerabilities.

Official
Intermediate
pluginagentmarketplacepluginagentmarketplace
4

go-modules

Initialize, tidy, vendor, and verify Go modules across workspaces.

Community
Advanced