This lesson's interactive features are locked, please to keep using them
Risks of Dependencies
Modern apps depend on code their teams didn't write, and each dependency can bring transitive modules, maintainers, release processes, and new code into your security boundary.
A transitive dependency is a module required by one of your dependencies rather than directly by your app. It can be several levels deep.
An outdated module might have a known vulnerability. A compromised maintainer might publish a malicious release. An unexpected replace directive can redirect a trusted module path to different code. That's a lot of trust for one dependency change.
Go records direct requirements in go.mod and cryptographic checksums for downloaded module versions in go.sum:
require example.com/imagekit v1.4.2
Minimal version selection makes the module graph deterministic for a given go.mod, while go.sum helps detect downloaded content that does not match the expected checksum. Neither mechanism proves the selected code is safe, maintained, or appropriate.
Reproducible module selection and verified checksums do not make the selected code trustworthy.
Before adding a module, inspect its purpose, maintenance, transitive growth, and any replace or exclude directives. Ask whether its capability is worth the extra code and attack surface. Good engineers don't add a dependency to avoid a small amount of straightforward code!