golang-dependency-management
Dependency management for Golang projects — go.mod and go.sum, go get install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, govulncheck scanning of the module tree, outdated dependency and binary size auditing, vendoring, tool directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See samber/cc-skills-golang@golang-security skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See samber/cc-skills-golang@golang-continuous-integration skill).
- Installs
- 40K
- Last 24h
- +162
- Trending rank
- #1432
- Security
- Pass
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/samber/cc-skills-golang --skill golang-dependency-management- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads golang-dependency-management automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.
Dependencies:
- govulncheck:
go install golang.org/x/vuln/cmd/govulncheck@latest
Go Dependency Management
AI Agent Rule: Ask Before Adding Dependencies
Before running go get to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using go get -u to upgrade an existing dependency is safe.
Before proposing a dependency, evaluate:
- Does the standard library already cover the use case?
- Is the license compatible?
- Are there well-known alternatives?
- What it does and why it's needed?
The samber/cc-skills-golang@golang-popular-libraries skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (golang.org/x/...) or established organizations over obscure alternatives.
Key Rules
go.sumMUST be committed — it records cryptographic checksums of every dependency version, lettinggo mod verifydetect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious codegovulncheck ./...orgo tool govulncheck ./...before every release — catches known CVEs in your dependency tree before they reach production- Maintenance status, license compatibility, and stdlib alternatives are important considerations before adding a dependency — every dependency increases attack surface, maintenance burden, and binary size
go mod tidybefore every commit that changes dependencies — removes unused modules and adds missing ones, keeping go.mod honest
go.mod & go.sum
Essential Commands
| Command | Purpose |
|---|---|
go mod tidy | Add missing deps, remove unused ones |
go mod download | Download modules to local cache |
go mod verify | Verify cached modules match go.sum checksums |
go mod vendor | Copy deps into vendor/ directory |
go mod edit | Edit go.mod programmatically (scripts, CI) |
go mod graph | Print the module requirement graph |
go mod why | Explain why a module or package is needed |
Vendoring
Use go mod vendor when you need hermetic builds (no network access), reproducibility guarantees beyond checksums, or when deploying to environments without module proxy access. CI pipelines and Docker builds sometimes benefit from vendoring. Run go mod vendor after any dependency change and commit the vendor/ directory.
Installing & Upgrading Dependencies
Adding a Dependency
go get github.com/google/uuid # Latest version
go get github.com/google/uuid@v1.6.0 # Specific version
go get github.com/google/uuid@latest # Explicitly latest
go get github.com/google/uuid@<commit> # Specific commit (pseudo-version)
Before pinning a version, inspect the module's available versions, importers, and known vulnerabilities on pkg.go.dev → See samber/cc-skills-golang@golang-pkg-go-dev skill.
Upgrading
go get -u ./... # Upgrade ALL direct+indirect deps to latest minor/patch
go get -u=patch ./... # Upgrade to latest patch only (safer)
go get github.com/pkg@v1.5 # Upgrade specific package
Prefer go get -u=patch for routine updates. Patch and minor updates are usually lower risk than major upgrades, but still require review. For dependency updates, run:
go get -u=patch ./...
go mod tidy
go test ./...
go vet ./...
govulncheck ./... # or: go tool govulncheck ./...
Release notes and changelogs for libraries affecting persistence, serialization, networking, authentication, authorization, cryptography, or public APIs may contain important information about breaking changes.
Removing a Dependency
go get github.com/google/uuid@none # Mark for removal
go mod tidy # Clean up go.mod and go.sum
Installing CLI Tools
For Go 1.24+ modules, pin executable tools in go.mod with tool directives. Do not create a new tools.go blank-import file unless the module must support Go <1.24.
# Add tools to the current module.
go get -tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
go get -tool golang.org/x/vuln/cmd/govulncheck@latest
go get -tool golang.org/x/perf/cmd/benchstat@latest
# Run pinned tools reproducibly.
go tool golangci-lint run ./...
go tool govulncheck ./...
go tool benchstat old.txt new.txt
# Install all module-pinned tools into GOBIN/PATH when needed.
go install tool
# Update pinned tools deliberately, then review go.mod/go.sum.
go get -u tool
go mod tidy
go.mod shape for a module targeting Go 1.27 or newer. This is an example target, not a cap; keep the project's actual go directive and do not change it just to add tools.
module example.com/project
go 1.27
tool (
github.com/golangci/golangci-lint/v2/cmd/golangci-lint
golang.org/x/vuln/cmd/govulncheck
golang.org/x/perf/cmd/benchstat
)
For go 1.27 or newer, go mod tidy auto-merges duplicate require blocks and enforces a two-block layout (direct dependencies, then indirect), preserving existing comments — no manual cleanup needed after a merge that introduces a second require block.
For Go <1.24 only, use the legacy tools.go blank-import workaround:
//go:build tools
package tools
import (
_ "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
_ "golang.org/x/vuln/cmd/govulncheck"
)
Rule: Go 1.24+ = tool directives. Go <1.24 = tools.go fallback.
Module target note
When using a newer toolchain, go mod init may create a module with an older default go directive. If the project intentionally targets the newer toolchain's APIs, update the directive deliberately:
go mod edit -go=1.27
go mod tidy
For future Go versions, use the project's intended target version. Do not use APIs newer than the module's go directive until the project explicitly agrees to upgrade it.
Deep Dives
-
Versioning & MVS — Semantic versioning rules (major.minor.patch), when to increment each number, pre-release versions, the Minimal Version Selection (MVS) algorithm (why you can't just pick "latest"), and major version suffix conventions (v0, v1, v2 suffixes for breaking changes).
-
Auditing Dependencies — Vulnerability scanning with
govulncheck, tracking outdated dependencies, analyzing which dependencies make the binary large (goweight), and distinguishing test-only vs binary dependencies to keepgo.modclean. -
Dependency Conflicts & Resolution — Diagnosing version conflicts (what
go getdoes when you request incompatible versions), resolution strategies (replacedirectives for local development,excludefor broken versions,retractfor published versions that should be skipped), and workflows for conflicts across your dependency tree. -
Go Workspaces —
go.workfiles for multi-module development (e.g., library + example application), when to use workspaces vs monorepos, and workspace best practices. -
Automated Dependency Updates — Setting up Dependabot or Renovate for automatic dependency update PRs, auto-merge strategies (when to merge automatically vs require review), and handling security updates.
-
Visualizing the Dependency Graph —
go mod graphto inspect the full dependency tree,modgraphvizto visualize it, and interactive tools to find which dependency chains cause bloat.
Cross-References
- → See
samber/cc-skills-golang@golang-continuous-integrationskill for Dependabot/Renovate CI setup - → See
samber/cc-skills-golang@golang-securityskill for vulnerability scanning with govulncheck - → See
samber/cc-skills-golang@golang-popular-librariesskill for vetted library recommendations
Quick Reference
# Start a new module
go mod init github.com/user/project
# Add a dependency
go get github.com/google/uuid@v1.6.0
# Upgrade all deps (patch only, safer)
go get -u=patch ./...
# Remove unused deps
go mod tidy
# Check for vulnerabilities
govulncheck ./... # or: go tool govulncheck ./...
# Check for outdated deps
go list -u -m -json all | go-mod-outdated -update -direct
# Analyze binary size by dependency
goweight
# Understand why a dep exists
go mod why -m github.com/some/module
# Visualize dependency graph
go mod graph | modgraphviz | dot -Tpng -o deps.png
# Verify checksums
go mod verify
FAQ
What does the golang-dependency-management skill do?
Dependency management for Golang projects — go.mod and go.sum, go get install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, govulncheck scanning of the module tree, outdated dependency and binary size auditing, vendoring, tool directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See samber/cc-skills-golang@golang-security skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See samber/cc-skills-golang@golang-continuous-integration skill).
How do I install golang-dependency-management?
Run npx skills add https://github.com/samber/cc-skills-golang --skill golang-dependency-management in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/golang-dependency-management/ (personal) or .claude/skills/golang-dependency-management/ (project).
Which AI agents can use golang-dependency-management?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is golang-dependency-management safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed; ZeroLeaks passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains golang-dependency-management?
It is published by samber in samber/cc-skills-golang. It has 39,964 recorded installs.
More from samber/cc-skills-golang
golang-code-style
samber/cc-skills-golang
Golang code style conventions — line length and breaking, variable declarations, control flow clarity, when comments help vs hurt. Use when writing or reviewing Go code, asking about style or clarity, or establishing project coding standards. Not for naming conventions (→ See samber/cc-skills-golang@golang-naming skill), linter configuration (→ See samber/cc-skills-golang@golang-lint skill), or doc comments (→ See samber/cc-skills-golang@golang-documentation skill).
golang-testing
samber/cc-skills-golang
Production-ready Golang tests — table-driven tests, testify suites and mocks, parallel tests, fuzzing, fixtures, goroutine leak detection with goleak, snapshot testing, code coverage, integration tests, idiomatic test naming. Use when writing or reviewing Go tests, choosing a testing approach, setting up Go test CI, or debugging flaky/slow tests. For testify-specific APIs see samber/cc-skills-golang@golang-stretchr-testify; for measurement methodology see samber/cc-skills-golang@golang-benchmark.
golang-error-handling
samber/cc-skills-golang
Idiomatic Golang error handling — creation, wrapping with %w, errors.Is/As, errors.Join, custom error types, sentinel errors, panic/recover, the single handling rule, structured logging with slog, HTTP request logging middleware, and samber/oops for production errors. Built to make logs usable at scale with log aggregation 3rd-party tools. Apply when creating, wrapping, inspecting, or logging errors in Go code. For samber/oops specifics → See samber/cc-skills-golang@golang-samber-oops skill; for slog handler ecosystem → See samber/cc-skills-golang@golang-samber-slog skill.
golang-security
samber/cc-skills-golang
Security best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus gosec SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See samber/cc-skills-golang@golang-safety skill), dependency vulnerability scanning with govulncheck (→ See samber/cc-skills-golang@golang-dependency-management skill), or wiring security scanners into CI pipelines (→ See samber/cc-skills-golang@golang-continuous-integration skill).
golang-design-patterns
samber/cc-skills-golang
Idiomatic Golang design patterns — functional options, constructor APIs, init() and global-state avoidance, enums, panic vs error decisions, resource management and lifecycle, graceful shutdown, timeouts and retries, streaming and iterators, and architecture styles (clean, hexagonal, DDD, flat). Apply when choosing between architectural patterns, implementing functional options, designing constructor APIs, setting up graceful shutdown, applying resilience patterns, or asking which idiomatic Go pattern fits a specific problem. Not for wiring a DI container or comparing DI libraries (→ See samber/cc-skills-golang@golang-dependency-injection skill), nor for error wrapping, errors.Is/As, or logging mechanics (→ See samber/cc-skills-golang@golang-error-handling skill).
golang-performance
samber/cc-skills-golang
Golang performance optimization patterns and methodology - if X bottleneck, then apply Y. Covers allocation reduction, CPU efficiency, memory layout, GC tuning, pooling, caching, and hot-path optimization. Use when profiling or benchmarks have identified a bottleneck and you need the right optimization pattern to fix it. Also use when performing performance code review to suggest improvements or benchmarks that could help identify quick performance gains. Not for measurement methodology (→ See samber/cc-skills-golang@golang-benchmark skill) or debugging workflow (→ See samber/cc-skills-golang@golang-troubleshooting skill).
Popular backend & apis skills
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.
design-an-interface
mattpocock/skills
Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".