Auditing Dependencies

Go provides separate checks for module integrity, module hygiene, and known vulnerabilities.

go mod verify
go mod tidy -diff
go run golang.org/x/vuln/cmd/govulncheck@latest ./...

• go mod verify checks that downloaded module content still matches the recorded hashes.
• go mod tidy -diff reports whether the module files, go.mod and go.sum, need any changes. Running it without -diff would also make those changes.
• govulncheck compares the application's reachable code with published Go vulnerability data.

A clean report is useful, but it is not proof that the dependencies are safe. An unpublished vulnerability, malicious behavior without an advisory, or risky application code could still be present even if all these checks pass.

When a scan does report a vulnerability, make sure to inspect the affected call path, the fixed version of the dependency, and possible compatibility impact before updating.