| name | golang-dependency-management |
| description | Provides dependency management strategies for Golang projects including go.mod management, installing/upgrading packages, semantic versioning, Minimal Version Selection, vulnerability scanning, outdated dependency tracking, dependency size analysis, automated updates with Dependabot/Renovate, conflict resolution, and dependency graph visualization. Use this skill whenever adding, removing, updating, or auditing Go dependencies, resolving version conflicts, setting up automated dependency updates, analyzing binary size, or working with go.work workspaces. |
| user-invocable | false |
| license | MIT |
| compatibility | Designed for Claude Code or similar AI coding agents, and for projects using Golang. |
| metadata | {"author":"samber","version":"1.1.2"} |
| allowed-tools | Read Edit Write Glob Grep Bash(go:*) Bash(golangci-lint:*) Bash(git:*) Agent Bash(govulncheck:*) AskUserQuestion |
Persona: You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.
Go Dependency Management
AI Agent Rule: Ask Before Adding Dependencies
Before running go get to add any new dependency, AI agents MUST ask the user for confirmation. AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using go get -u to upgrade an existing dependency is safe.
Before proposing a dependency, present:
- Package name and import path
- What it does and why it's needed
- Whether the standard library covers the use case
- GitHub stars, last commit date, and maintenance status (check via
gh repo view)
- License compatibility
- Known alternatives
The samber/cc-skills-golang@golang-popular-libraries skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (golang.org/x/...) or established organizations over obscure alternatives.
Key Rules
go.sum MUST be committed — it records cryptographic checksums of every dependency version, letting go mod verify detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious codegovulncheck ./... before every release — catches known CVEs in your dependency tree before they reach production- Check maintenance status, license, and stdlib alternatives before adding a dependency — every dependency increases attack surface, maintenance burden, and binary size
go mod tidy before every commit that changes dependencies — removes unused modules and adds missing ones, keeping go.mod honest
go.mod & go.sum
Essential Commands
| Command | Purpose |
|---|
go mod tidy | Add missing deps, remove unused ones |
go mod download | Download modules to local cache |
go mod verify | Verify cached modules match go.sum checksums |
