golang-dependency-management

Use go get -u=patch ./... for routine updates since patch versions carry no API changes per semver. Follow with go mod tidy, go test ./..., go vet ./..., and govulncheck ./... to verify the upgrade is safe.

Run govulncheck ./... to scan your dependency tree for known CVEs. Unlike generic scanners, govulncheck uses static analysis to trace call paths, so it only flags vulnerabilities in functions your code actually calls.

Yes, go.sum must always be committed. It records cryptographic checksums of every dependency version, letting go mod verify detect supply-chain tampering if a compromised proxy substitutes malicious code.

Replace substitutes a module version or path in the main module only, exclude blocks a specific broken version of a dependency, and retract marks your own published versions as broken. Replace and exclude are consumer-side; retract is author-side.

MVS selects the minimum version satisfying all requirements, not the latest available like npm or pip. If module A requires pkg@v1.2.0 and module B requires pkg@v1.3.0, Go selects v1.3.0, giving deterministic builds without a lock file.

For Go 1.24+, use go get -tool to add tool directives in go.mod, then run them with go tool golangci-lint. For Go versions below 1.24, use the legacy tools.go blank-import workaround instead.