skills.rest
vanstinator
vanstinatorCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

golang-dependency-management

Manage Go dependencies with go.mod, go.sum, and govulncheck.

Updated May 28, 2026
Search Tags:#automation#vulnerability scanning#govulncheck#go mod tidy#go modules#dependency upgrades#MVS resolution
One-click install
npx skills add https://github.com/vanstinator/semantic-search --skill golang-dependency-management-vanstinator
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: golang-dependency-management
Source: https://github.com/vanstinator/semantic-search/tree/main/.agents/skills/golang-dependency-management
Command: npx skills add https://github.com/vanstinator/semantic-search --skill golang-dependency-management-vanstinator

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you manage Go project dependencies without creating long-term maintenance, security, or build reproducibility problems when adding, upgrading, or removing packages.

Core Features & Use Cases

  • Dependency hygiene: Keeps go.mod and go.sum accurate with go mod tidy, prevents missing checksums, and supports vendoring for hermetic builds.
  • Security auditing: Guides vulnerability scanning with govulncheck to catch only vulnerabilities that are actually reachable from your code.
  • Conflict prevention & resolution: Explains Minimal Version Selection (MVS), version suffix rules, and practical strategies like replace/exclude/retract, plus automated update workflows.

Quick Start

Ask the AI assistant to propose the safest way to upgrade your Go dependencies and verify there are no known reachable vulnerabilities before you commit changes.

Frequently Asked Questions about golang-dependency-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely upgrade Go dependencies without breaking build reproducibility?▼

To safely upgrade Go dependencies, apply patch-only version bumps, execute go mod tidy to synchronize go.mod and go.sum, and run go mod verify to ensure checksums match before committing changes.

How does govulncheck scan Go modules for security vulnerabilities?▼

govulncheck performs security auditing by analyzing your Go dependency tree and reporting only known vulnerabilities that are actually reachable from your application code, preventing false positives.

What is Minimal Version Selection (MVS) and how does it resolve Go module conflicts?▼

Minimal Version Selection (MVS) is Go's dependency resolution algorithm that selects the minimum version required by any module, preventing unexpected version jumps and reducing conflict scenarios.

When should I use replace, exclude, or retract directives in go.mod?▼

Use replace directives to redirect module paths locally, exclude to skip broken versions, and retract to flag problematic published versions, resolving MVS-related surprises and dependency conflicts safely.

Can I automate Go dependency upgrades with Dependabot or Renovate?▼

Yes, you can automate Go dependency upgrades by configuring Dependabot or Renovate workflows to propose version bumps, then validating changes using go mod tidy and govulncheck before merging.

Why does go mod tidy remove unused modules from my go.sum file?▼

go mod tidy removes unused modules from go.sum to maintain dependency hygiene, ensuring your checksum file accurately reflects only the packages required for building your current Go project.

Related Skills

Explore More Software Engineering Skills→
motlinmotlin
14

git-workflow

Standardize git commits, rebasing, conflict resolution, and branch management.

Community
Basic
omarluqomarluq
5

golang-dependency-management

Manage Golang dependencies across modules, go.work, and auditing workflows.

Community
Advanced
sambersamber
2.9k

golang-lint

Configure and run golangci-lint to analyze Go projects and interpret results.

Community
Advanced
dashkandashkan
1

golang-dependency-management

Manage Go module dependencies with go.mod, go.sum, and govulncheck workflows.

Community
Intermediate