Auditing Dependencies

Go provides separate checks for module integrity, module hygiene, and known vulnerabilities.

go mod verify
go mod tidy -diff
go run golang.org/x/vuln/cmd/[email protected] ./...

go mod verify checks that downloaded module content still matches its recorded hashes. go mod tidy -diff reports whether the module files need changes without rewriting them. govulncheck compares the application's reachable code with published Go vulnerability data.

A clean report is useful, but it is not proof that the dependencies are safe. An unpublished vulnerability, malicious behavior without an advisory, or risky application code will not appear merely because the module graph verifies.

When a scan reports a reachable vulnerability, inspect the affected call path, fixed version, and compatibility impact before updating.