golang-dependency-management

Run `go get -u=patch ./...` to upgrade only patch versions, which carry no API changes per semver, then run `go mod tidy`, `go test ./...`, and `govulncheck ./...`. Plain `go get -u ./...` also upgrades minor versions, which can change behavior.

Yes, go.sum must always be committed. It records cryptographic checksums of every dependency version, letting `go mod verify` detect supply-chain tampering; without it, a compromised proxy could substitute malicious code.

Go uses Minimal Version Selection: it picks the highest minimum version required across the module graph, not the latest available like npm or pip. This gives deterministic builds without a lock file; go.sum is integrity verification only.

No. Replace and exclude directives only take effect in the main module's go.mod and are ignored when your module is consumed as a dependency. Remove replace directives before publishing a library.

For Go 1.24+, use tool directives: run `go get -tool <package>@latest` to pin tools in go.mod, then execute them reproducibly with `go tool <name>`. Only use the legacy tools.go blank-import file for modules targeting Go below 1.24.

No. govulncheck uses static analysis to trace call paths from your code to vulnerable functions, so it only reports vulnerabilities that are actually reachable, unlike generic CVE scanners that flag any flagged dependency's presence.