Go
Go modules, diffed with apidiff, located with go/types, and security advisories judged by govulncheck on the code you actually call.
| Go | |
|---|---|
| Manifests | every go.mod (not vendor, testdata or examples), go.work module by module |
| Versions | from the Go toolchain: go list -m all on a scratch copy, as minimal version selection picks them |
| API diff | golang.org/x/exp/apidiff in Teire's Go helper |
| Finds your lines with | go/types, over your packages and tests |
| Advisories | govulncheck v1.8.0: called, imported or only required |
| Sandbox | Go 1.27.2 |
| Docs for the agent | the target module's own exported declarations and doc comments |
What Teire reads
Versions come from the toolchain itself, run in a safe mode:
GOTOOLCHAIN=local,CGO_ENABLED=0,GOWORK=off,- the public Go proxy only, with
GOVCS=*:off, - a scratch home directory.
// indirect requirements are transitive; local replace directives keep their versions, with a note.
The next version may be a new major. Teire merges the versions of the module you have with those of /v2, /v3… (or gopkg.in .vN), checking up to 6 majors on the proxy. Pseudo-versions are skipped.
A version is never a target when Go itself steers away from it:
- Retracted by its authors. Each module path's retractions are read the way Go reads them: from the
go.modof the proxy's@latest, parsed bygo mod edit -json. If the version you have is retracted, the report says so with the authors' reason. - Excluded by your
go.mod. Anexcludeline keeps that version out.
How breaks are found
apidiff compares the two versions' exported API and ignores the noise of the /vN path. A trailing ...Option parameter added to a function is an annotation, not a break. Teire's helper then loads your packages with go/types and records every use of a changed object, resolved by type. Code that didn't type-check has no resolved uses, so it never counts as "unused": a reference the checker couldn't resolve, and every package that failed to load while importing the module, keep the verdict inconclusive.
A fix that exists only as a commit (the advisory's fix is a pseudo-version, with no tagged release after it) is still a target, if the proxy serves that commit. dependabot-core's updater is asked first. Its Go finder lists tagged releases only, so when it can't reach the commit, Teire moves the module there with go get module@<pseudo-version>. Only if both refuse does a person get an issue.
For advisories, govulncheck decides. If your code calls the vulnerable function, the finding is affected, with the call site. If the module is only imported or required, it is not affected, and the report says how far govulncheck could see; your tests aren't part of that analysis.
How it upgrades
- Within a major:
go get module@version, never-u. - Across a major: Teire first rewrites your import paths (
…/v4→…/v5, keeping aliases). Thengo get,go mod tidy, andgo mod vendorwhen the module vendors.
How it verifies
go mod download with GOTOOLCHAIN=local. Then, with GOPROXY=off and -mod=readonly:
| Check | Command |
|---|---|
| build | go build -o /dev/null ./... |
| typecheck | go vet ./... |
| test | go test -count=1 -json ./..., with build tags taken from your CI |
In the evaluation
golang-jwt/jwt v4.5.2 → v5.3.1 on demo-go-major: 4 sites, verified by Nemotron 3 Ultra in 1 attempt. The fix replaced StandardClaims with RegisteredClaims, Unix times with NewNumericDate, and the ValidationError bitmask with errors.Is(err, jwt.ErrTokenExpired). See Anatomy of a Teire PR. The same upgrade on demo-go-clean was judged not affected by type, and verified as a plain bump.
Limits
Private modules that the public proxy can't serve keep the versions go.mod states, with a note in the report. Release notes are read from GitHub, GitLab or Bitbucket; a vanity path (go.uber.org/zap, golang.org/x/net) is followed through its go-import tag the way go get does, and a module in a subdirectory reads its sub/vX.Y.Z tags. Self-hosted forges aren't read. The sandbox has Go 1.27.2, and targets needing a newer Go aren't excluded. -race isn't run, because the sandbox has no cgo toolchain.