Ecosystem · Go · modules
Vulnerabilities in your Go modules, read from go.mod and go.sum.
LibWatch reads go.mod and go.sum, checks every module and flags a Go version that has fallen behind. Without compiling or running your code.
What LibWatch reads in the repository
go.modgo.sum
Language version: go directive and toolchain in go.mod
Nothing else: no cloning, no code run.
What LibWatch checks
The modules, and the Go version
Go packages
Known vulnerabilities
Every package in the lockfile checked against OSV, which includes GitHub advisories.
Go version
End of life
The declared version is tracked: you know when it stops getting fixes.
Health
License policy
Licenses that conflict with your project's policy are flagged.
An alert, in practice
A vulnerability in a module, with the version that fixes it
The vulnerabilities that affect your versions, with the fixed version. Nothing more.
Real severity
CVSS severity and presence in the CISA KEV catalog
What to do
The fixed version, and the affected project
Where
Email, Slack, Zulip or webhook, set per project
gateway · Go
Example · analysis from October 22
-
End of life
Go (declared)
go 1.22
-
Medium severity
golang.org/x/net
v0.21.0
-
Up to date
github.com/gin-gonic/gin
v1.10.0
Rechecked every night at 2 a.m.
Tracked versions
Go only fixes its two latest releases: LibWatch flags a go.mod that has fallen behind.
- go.mod · go directive
- go.mod · toolchain
- go.sum
Get started
Your first report in a few minutes
No pipeline to change.
Connect GitHub or GitLab
Self-hosted GitLab instances included.
Choose your Go repositories
LibWatch finds the files listed above on its own, even in a monorepo.
Read the report, set up alerts
Exploited vulnerabilities first, fixed versions, language end of life.
Frequently asked questions
LibWatch and Go
Do I need to install anything in the project?
No. LibWatch reads dependency files through the GitHub or GitLab API, without adding anything to your pipeline.
Are private registries supported?
Yes. A package from a private registry is identified as such: its name is never sent to a third-party service, and it stays in the project's inventory.
Does LibWatch detect the version installed on the server?
No. LibWatch reads the version declared in the repository (version file, lockfile or manifest). It has no access to your servers.