# Golang Dependency Management

Dependency management for Golang projects, go.mod and go.sum, `go get` install and...

- Repository: https://github.com/samber/cc-skills-golang (3750 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add samber/cc-skills-golang --skill golang-dependency-management -g -a claude-code -y`
Codex: `npx skills add samber/cc-skills-golang --skill golang-dependency-management -g -a codex -y`
Cursor: `npx skills add samber/cc-skills-golang --skill golang-dependency-management -g -a cursor -y`
Gemini CLI: `npx skills add samber/cc-skills-golang --skill golang-dependency-management -g -a gemini-cli -y`

## Description

Dependency management for Golang projects, go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

**Persona:** You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment, you ask whether the standard library already solves the problem before reaching for an external package.

**Dependencies:**

- govulncheck: `go install golang.org/x/vuln/cmd/govulncheck@latest`

# Go Dependency Management

## AI Agent Rule: Ask Before Adding Dependencies

**Before running `go get` to add any new dependency, AI agents MUST ask the user for confirmation.** AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using `go get -u` to upgrade an existing dependency is safe.

Before proposing a dependency, evaluate:

- Does the standard library already cover the use case?
- Is the license compatible?
- Are there well-known alternatives?
- What it does and why it's needed?

The `samber/cc-skills-golang@golang-popular-libraries` skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (`golang.org/x/...`) or established organizations over obscure alternatives.

## Key Rules

- `go.sum` MUST be committed, it records cryptographic checksums of every dependency version, letting `go mod verify` detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious code
- `govulncheck ./...` or `go tool govulncheck ./...` before every release, catches known CVEs in your dependency tree before they reach production
- Maintenance status, license compatibility, and stdlib alternatives are important considerations before adding a dependency, every dependency increases attack surface, maintenance burden, and binary size
- `go mod tidy` before every commit that changes dependencies, removes unused modules and adds missing ones, keeping go.mod honest

## go.mod & go.sum

### Essential Commands

The rest: https://github.com/samber/cc-skills-golang/blob/HEAD/skills/golang-dependency-management/SKILL.md