Go Module Hygiene: Keeping go.sum and go.mod in check
summary
Practical checklist for keeping go.mod and go.sum healthy: run go mod tidy regularly to remove unused deps, use go mod vendor when builds must not pull remote code, pin exact versions for CI reproducibility, and add automated CI vulnerability scans that fail builds on checksum or CVE changes. Watch for three red flags — slow builds, ballooning binaries, and mysterious runtime errors — and document version decisions plus tests before upgrading to avoid surprising regressions.
AI-written summary · about
chapters (19)
- 0:00Go Module Hygiene intro
- 2:54go.mod and go.sum explained
- 7:10Unhealthy module symptoms
- 14:27Cleaning deps with go mod tidy
- 15:31Dependency graph mapping
- 16:55Dependency origins with go mod why
- 18:00Pinning deps for stability
- 20:09Evaluating third-party deps
- 21:33Checking dep maintenance
- 23:43Regular dep pruning
- 25:11Dependency security risks
- 27:45Automated vulnerability scanning
- 28:28Using go mod vendor
- 29:34go.sum and supply chain attacks
- 30:36Sustainable module habits
- 32:02Automating checks in CI/CD
- 33:31Testing deps before updates
- 34:12Key takeaways and best practices
- 41:51Q&A
related talks
38mUsing Go Modules in everyday life
28mFinding Dependable Go Packages
07mSecurity of Go Modules and Vulnerability Scanning in GoCenter
21mVulnerability Management for Go
25mExploring Some Essential Security Checks for Any Open Source Go Project
38mGo Module Proxy: Life of a Query
24mGoing Secure with Go
05mLightning Talk: Improving The Security Of Your Go Applications