Go modules

Keep track of Go dependencies with the Go project's own services: search packages, see a module's versions and when each was published, find the latest, read a version's go.mod and checksums, spot retracted and deprecated versions, check a version against the Go vulnerability database, and follow new releases and new vulnerability reports as they appear. No account or API key is required.

Actions

Action	What it does
Check a module for vulnerabilities	Check whether a version of a Go module is affected by any known vulnerability in the Go vulnerability database, with each one's fix and the lowest version that fixes them all.
Get a module	Get a Go module's latest version and when it was published, its source repository and licence, the Go version it needs, the versions its authors have retracted, whether it is deprecated, and whether a newer major version (/v2, /v3...) exists.
Get a module version	Get one version of a Go module: when it was published, the commit and tag it was built from, its checksums from the Go checksum database, whether it is retracted or deprecated, and whether a newer version is out.
Get a package	Get a Go package from pkg.go.dev: the module it belongs to, its one-line summary, its licence, the packages it imports and how many packages and modules import it.
Get a vulnerability	Get a report from the Go vulnerability database by its Go id (GO-2022-0603), CVE or GitHub advisory (GHSA) id: what it is, which modules and versions it affects, where it is fixed, the affected packages and functions, and links.
Get module dependencies	Read a Go module version's go.mod file: every module it requires and at what version (marked direct or indirect), its replace and exclude rules, the versions it retracts and why, and the Go version it needs.
List module versions	List the tagged versions of a Go module, newest first, with the date each was published and whether its authors have retracted it.
List new vulnerabilities	List reports added to or changed in the Go vulnerability database since a moment you choose, most recent first, optionally only for modules under a path such as golang.org/x. Run it on a schedule to hear about new vulnerabilities in what you depend on.
List newly published versions	List module versions as they are published to the Go module mirror, oldest first, from the moment you choose, optionally only for modules under a path such as github.com/your-org.
Search Go packages	Search pkg.go.dev for Go packages by name or topic, best match first, with each package's module, latest version, one-line summary and how many other packages import it.

Check a module for vulnerabilities

Check whether a version of a Go module is affected by any known vulnerability in the Go vulnerability database, with each one's fix and the lowest version that fixes them all. Use std as the module to check a Go release (for example 1.22.1). It checks the version, not whether your code calls the affected functions.

Inputs

Module pathmoduletextRequired: The module's path, for example golang.org/x/net. Use std to check Go itself.
Versionversiontext: The version you use, for example v0.22.0 (or 1.22.1 for Go). Leave empty to check the latest.

Outputs

affectedtrue/false
all_fixedtrue/false
known_vulnerability_countnumber
moduletext
upgrade_totext
urltext
versiontext
vulnerabilitieslist
vulnerability_countnumber
vulnerability_idslist

Example output

{
  "affected": true,
  "all_fixed": true,
  "known_vulnerability_count": 35,
  "module": "golang.org/x/net",
  "upgrade_to": "v0.23.0",
  "url": "https://pkg.go.dev/vuln/list?q=golang.org/x/net",
  "version": "v0.22.0",
  "vulnerabilities": [
    {
      "affected_versions": "before v0.23.0",
      "aliases": [
        "CVE-2023-45288",
        "GHSA-4v7x-pqxf-cx7m"
      ],
      "cve_ids": [
        "CVE-2023-45288"
      ],
      "fixed_version": "v0.23.0",
      "id": "GO-2024-2687",
      "packages": [
        "golang.org/x/net/http2"
      ],
      "published_at": "2024-04-03T21:12:01Z",
      "summary": "HTTP/2 CONTINUATION flood in net/http",
      "url": "https://pkg.go.dev/vuln/GO-2024-2687"
    }
  ],
  "vulnerability_count": 1,
  "vulnerability_ids": [
    "GO-2024-2687"
  ]
}

Get a module

Get a Go module's latest version and when it was published, its source repository and licence, the Go version it needs, the versions its authors have retracted, whether it is deprecated, and whether a newer major version (/v2, /v3...) exists. "Latest" means what go get would choose: retracted versions are skipped.

Inputs

Module pathmoduletextRequired: The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.

Outputs

committext
deprecatedtrue/false
deprecation_messagetext
go_versiontext
is_pseudo_versiontrue/false
latest_versiontext
licenseslist
moduletext
newer_major_versiontext
newer_major_version_moduletext
published_attext
redistributabletrue/false
repository_urltext
retractedlist
urltext
version_countnumber

Example output

{
  "commit": "75de7c059e36b64f01d0dd234ff2fff404ec3374",
  "deprecated": true,
  "deprecation_message": "Use the \"google.golang.org/protobuf\" module instead.",
  "go_version": "1.17",
  "is_pseudo_version": false,
  "latest_version": "v1.5.4",
  "licenses": [
    "BSD-3-Clause"
  ],
  "module": "github.com/golang/protobuf",
  "newer_major_version": null,
  "newer_major_version_module": null,
  "published_at": "2024-03-06T06:45:40Z",
  "redistributable": true,
  "repository_url": "https://github.com/golang/protobuf",
  "retracted": [],
  "url": "https://pkg.go.dev/github.com/golang/protobuf",
  "version_count": 22
}

Get a module version

Get one version of a Go module: when it was published, the commit and tag it was built from, its checksums from the Go checksum database, whether it is retracted or deprecated, and whether a newer version is out. Also gives the link to download its source.

Inputs

Module pathmoduletextRequired: The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.
Versionversiontext: Leave empty for the latest version. Pick one of the module's tagged versions, or type a branch name or commit hash.

Outputs

checksumtext
committext
deprecatedtrue/false
deprecation_messagetext
go_mod_checksumtext
go_versiontext
is_latesttrue/false
is_pseudo_versiontrue/false
latest_versiontext
moduletext
prereleasetrue/false
published_attext
repository_urltext
retractedtrue/false
retraction_reasontext
tagtext
update_availabletrue/false
urltext
versiontext
zip_urltext

Example output

{
  "checksum": "h1:sxRSkyLxlceWQiqDofxDot3d4u7DyoHPc7SBXMj8gGY=",
  "commit": "406c2bf4972d72d1746b156e5989228b094d6d3e",
  "deprecated": false,
  "deprecation_message": null,
  "go_mod_checksum": "h1:NZUaK8dAMUfzhK6uxZ+9511LtOrk73UGWOFoNvz7z+s=",
  "go_version": "1.23.0",
  "is_latest": false,
  "is_pseudo_version": false,
  "latest_version": "v1.84.0",
  "module": "google.golang.org/grpc",
  "prerelease": false,
  "published_at": "2025-07-16T18:37:53Z",
  "repository_url": "https://github.com/grpc/grpc-go",
  "retracted": true,
  "retraction_reason": "v1.74.0 was published prematurely with known issues.",
  "tag": "v1.74.0",
  "update_available": true,
  "url": "https://pkg.go.dev/google.golang.org/grpc@v1.74.0",
  "version": "v1.74.0",
  "zip_url": "https://proxy.golang.org/google.golang.org/grpc/@v/v1.74.0.zip"
}

Get a package

Get a Go package from pkg.go.dev: the module it belongs to, its one-line summary, its licence, the packages it imports and how many packages and modules import it. Works for the standard library too (fmt, net/http).

Inputs

Package pathpackagetextRequired: The package's import path, for example golang.org/x/net/html or net/http.
Versionversiontext: The module version to read, for example v0.20.0. Leave empty for the latest.

Outputs

imported_by_countnumber
imported_by_module_countnumber
importslist
is_commandtrue/false
is_latesttrue/false
is_standard_librarytrue/false
licenseslist
moduletext
nametext
packagetext
redistributabletrue/false
synopsistext
urltext
versiontext

Example output

{
  "imported_by_count": 16083,
  "imported_by_module_count": 12900,
  "imports": [
    "golang.org/x/net/html/atom",
    "bufio",
    "bytes",
    "errors",
    "io"
  ],
  "is_command": false,
  "is_latest": true,
  "is_standard_library": false,
  "licenses": [
    "BSD-3-Clause"
  ],
  "module": "golang.org/x/net",
  "name": "html",
  "package": "golang.org/x/net/html",
  "redistributable": true,
  "synopsis": "Package html implements an HTML5-compliant tokenizer and parser.",
  "url": "https://pkg.go.dev/golang.org/x/net/html",
  "version": "v0.61.0"
}

Get a vulnerability

Get a report from the Go vulnerability database by its Go id (GO-2022-0603), CVE or GitHub advisory (GHSA) id: what it is, which modules and versions it affects, where it is fixed, the affected packages and functions, and links.

Inputs

Vulnerability idvulnerability_idtextRequired: A Go id such as GO-2022-0603, a CVE such as CVE-2022-28948, or a GHSA id.

Outputs

affectedlist
aliaseslist
creditslist
cve_idslist
detailstext
ghsa_idslist
idtext
modified_attext
moduleslist
other_report_idslist
published_attext
referenceslist
review_statustext
summarytext
urltext
withdrawn_attext

Example output

{
  "affected": [
    {
      "affected_versions": "before v3.0.0-20220521103104-8f96da9f5d5e",
      "fixed_versions": [
        "v3.0.0-20220521103104-8f96da9f5d5e"
      ],
      "module": "gopkg.in/yaml.v3",
      "packages": [
        {
          "architectures": [],
          "operating_systems": [],
          "path": "gopkg.in/yaml.v3",
          "symbols": [
            "Unmarshal"
          ]
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-28948",
    "GHSA-hp87-p4gw-j4gq"
  ],
  "credits": [],
  "cve_ids": [
    "CVE-2022-28948"
  ],
  "details": "An issue in the Unmarshal function can cause a program to panic when attempting to deserialize invalid input.",
  "ghsa_ids": [
    "GHSA-hp87-p4gw-j4gq"
  ],
  "id": "GO-2022-0603",
  "modified_at": "2024-05-20T16:03:47Z",
  "modules": [
    "gopkg.in/yaml.v3"
  ],
  "other_report_ids": [],
  "published_at": "2022-08-22T18:00:47Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754"
    }
  ],
  "review_status": "REVIEWED",
  "summary": "Panic in gopkg.in/yaml.v3",
  "url": "https://pkg.go.dev/vuln/GO-2022-0603",
  "withdrawn_at": null
}

Get module dependencies

Read a Go module version's go.mod file: every module it requires and at what version (marked direct or indirect), its replace and exclude rules, the versions it retracts and why, and the Go version it needs. The file itself is included too.

Inputs

Module pathmoduletextRequired: The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.
Versionversiontext: Leave empty for the latest version. Pick one of the module's tagged versions, or type a branch name or commit hash.

Outputs

dependency_countnumber
deprecatedtrue/false
deprecation_messagetext
direct_dependency_countnumber
excludeslist
go_modtext
go_versiontext
godebuglist
indirect_dependency_countnumber
moduletext
replaceslist
requireslist
retractedlist
toolchaintext
toolslist
versiontext

Example output

{
  "dependency_count": 3,
  "deprecated": false,
  "deprecation_message": null,
  "direct_dependency_count": 2,
  "excludes": [],
  "go_mod": "module google.golang.org/grpc\n\ngo 1.25.0\n\nrequire (\n\tgithub.com/google/uuid v1.6.0\n\tgolang.org/x/net v0.57.0\n)\n\nrequire golang.org/x/text v0.40.0 // indirect\n\n// v1.74.0 was published prematurely with known issues.\nretract [v1.74.0, v1.74.1]\n",
  "go_version": "1.25.0",
  "godebug": [],
  "indirect_dependency_count": 1,
  "module": "google.golang.org/grpc",
  "replaces": [],
  "requires": [
    {
      "indirect": false,
      "module": "github.com/google/uuid",
      "version": "v1.6.0"
    },
    {
      "indirect": false,
      "module": "golang.org/x/net",
      "version": "v0.57.0"
    },
    {
      "indirect": true,
      "module": "golang.org/x/text",
      "version": "v0.40.0"
    }
  ],
  "retracted": [
    {
      "from_version": "v1.74.0",
      "reason": "v1.74.0 was published prematurely with known issues.",
      "to_version": "v1.74.1"
    }
  ],
  "toolchain": null,
  "tools": [],
  "version": "v1.84.0"
}

List module versions

List the tagged versions of a Go module, newest first, with the date each was published and whether its authors have retracted it.

Inputs

Module pathmoduletextRequired: The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.
Include pre-releasesinclude_prereleasestrue/false: Also list pre-release versions such as v2.0.0-rc.1.Default: true.
Number of versionslimitnumber: How many versions to return, newest first.From 1 to 100. Default: 20.

Outputs

latest_versiontext
moduletext
version_countnumber
version_listlist
versionslist

Example output

{
  "latest_version": "v9.23.0",
  "module": "github.com/redis/go-redis/v9",
  "version_count": 67,
  "version_list": [
    "v9.23.0",
    "v9.15.0"
  ],
  "versions": [
    {
      "is_latest": true,
      "prerelease": false,
      "published_at": "2026-10-05T14:51:38Z",
      "retracted": false,
      "retraction_reason": null,
      "url": "https://pkg.go.dev/github.com/redis/go-redis/v9@v9.23.0",
      "version": "v9.23.0"
    },
    {
      "is_latest": false,
      "prerelease": false,
      "published_at": "2025-09-26T16:40:07Z",
      "retracted": true,
      "retraction_reason": "This version was accidentally released.",
      "url": "https://pkg.go.dev/github.com/redis/go-redis/v9@v9.15.0",
      "version": "v9.15.0"
    }
  ]
}

List new vulnerabilities

List reports added to or changed in the Go vulnerability database since a moment you choose, most recent first, optionally only for modules under a path such as golang.org/x. Run it on a schedule to hear about new vulnerabilities in what you depend on.

Inputs

Sincesincedate and time: Only reports published or changed at or after this moment. Leave empty for the last 7 days.
Module pathmoduletext: Only reports for this module or modules under it, for example golang.org/x. Use std for Go itself. Leave empty for every module.
Only newly published reportsonly_newtrue/false: Leave out older reports that were only edited in the period.Default: false.
Number of reportslimitnumber: How many reports to return, most recent first.From 1 to 100. Default: 20.

Outputs

more_availabletrue/false
sincetext
vulnerabilitieslist
vulnerability_countnumber
vulnerability_idslist

Example output

{
  "more_available": false,
  "since": "2026-10-01T00:00:00Z",
  "vulnerabilities": [
    {
      "aliases": [
        "CVE-2026-97032"
      ],
      "cve_ids": [
        "CVE-2026-97032"
      ],
      "details": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.",
      "id": "GO-2026-6617",
      "is_new": true,
      "modified_at": "2026-10-08T22:31:09Z",
      "modules": [
        "stdlib",
        "golang.org/x/net"
      ],
      "published_at": "2026-10-08T22:31:09Z",
      "summary": "HTTP/2 server crash due to HPACK encoder race in net/http",
      "url": "https://pkg.go.dev/vuln/GO-2026-6617",
      "withdrawn": false
    }
  ],
  "vulnerability_count": 1,
  "vulnerability_ids": [
    "GO-2026-6617"
  ]
}

List newly published versions

List module versions as they are published to the Go module mirror, oldest first, from the moment you choose, optionally only for modules under a path such as github.com/your-org. Feed Next since into the following run to see every version exactly once.

Inputs

Sincesincedate and time: Only versions published at or after this moment. Leave empty for the last hour.
Module pathmodule_prefixtext: Only this module or modules under it, for example github.com/aws. Leave empty for every module.
Include untagged commitsinclude_pseudo_versionstrue/false: Also list pseudo-versions: commits fetched by someone without a release tag. Most of the index is these.Default: false.
Number of versionslimitnumber: How many versions to return, oldest first.From 1 to 2000. Default: 100.

Outputs

caught_uptrue/false
next_sincetext
sincetext
version_countnumber
versionslist

Example output

{
  "caught_up": true,
  "next_since": "2026-10-14T00:04:09.140479Z",
  "since": "2026-10-14T00:00:00Z",
  "version_count": 1,
  "versions": [
    {
      "is_pseudo_version": false,
      "module": "github.com/aws/aws-sdk-go-v2/service/s3",
      "prerelease": false,
      "published_at": "2026-10-14T00:04:09Z",
      "url": "https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3@v1.88.4",
      "version": "v1.88.4"
    }
  ]
}

Search Go packages

Search pkg.go.dev for Go packages by name or topic, best match first, with each package's module, latest version, one-line summary and how many other packages import it. Use it to find the module path the other actions need.

Inputs

Search forquerytextRequired: Words to search for, for example yaml or http router.
Number of resultslimitnumber: How many packages to return, best match first.From 1 to 100. Default: 10.

Outputs

querytext
result_countnumber
resultslist

Example output

{
  "query": "toml",
  "result_count": 1,
  "results": [
    {
      "imported_by_count": 38240,
      "module": "github.com/BurntSushi/toml",
      "package": "github.com/BurntSushi/toml",
      "synopsis": "Package toml implements decoding and encoding of TOML files.",
      "url": "https://pkg.go.dev/github.com/BurntSushi/toml",
      "version": "v1.6.0"
    }
  ]
}

ActionsCopy Anchor Link

Check a module for vulnerabilitiesCopy Anchor Link

Inputs

Outputs

Get a moduleCopy Anchor Link

Inputs

Outputs

Get a module versionCopy Anchor Link

Inputs

Outputs

Get a packageCopy Anchor Link

Inputs

Outputs

Get a vulnerabilityCopy Anchor Link

Inputs

Outputs

Get module dependenciesCopy Anchor Link

Inputs

Outputs

List module versionsCopy Anchor Link

Inputs

Outputs

List new vulnerabilitiesCopy Anchor Link

Inputs

Outputs

List newly published versionsCopy Anchor Link

Inputs

Outputs

Search Go packagesCopy Anchor Link

Inputs

Outputs

On this page

Actions

Check a module for vulnerabilities

Get a module

Get a module version

Get a package

Get a vulnerability

Get module dependencies

List module versions

List new vulnerabilities

List newly published versions

Search Go packages