# Go modules

> Keep track of Go dependencies with the Go project's own services: search packages, see a module's versions and when each was published, find the latest, read a version's go.mod and checksums, spot retracted and deprecated versions, check a version against the Go vulnerability database, and follow new releases and new vulnerability reports as they appear. No account or API key is required.

App · 10 actions. Web page: https://docs.lodol.com/docs/integrations/go-modules

## Actions

### Check a module for vulnerabilities

Check whether a version of a Go module is affected by any known vulnerability in the Go vulnerability database, with each one's fix and the lowest version that fixes them all. Use std as the module to check a Go release (for example 1.22.1). It checks the version, not whether your code calls the affected functions.

**Inputs**

- Module path (`module`, text, required): The module's path, for example golang.org/x/net. Use std to check Go itself.
- Version (`version`, text): The version you use, for example v0.22.0 (or 1.22.1 for Go). Leave empty to check the latest.

**Outputs**

- `affected` (true/false)
- `all_fixed` (true/false)
- `known_vulnerability_count` (number)
- `module` (text)
- `upgrade_to` (text)
- `url` (text)
- `version` (text)
- `vulnerabilities` (list)
- `vulnerability_count` (number)
- `vulnerability_ids` (list)

**Example output**

```json
{
  "affected": true,
  "all_fixed": true,
  "known_vulnerability_count": 35,
  "module": "golang.org/x/net",
  "upgrade_to": "v0.23.0",
  "url": "https://pkg.go.dev/vuln/list?q=golang.org/x/net",
  "version": "v0.22.0",
  "vulnerabilities": [
    {
      "affected_versions": "before v0.23.0",
      "aliases": [
        "CVE-2023-45288",
        "GHSA-4v7x-pqxf-cx7m"
      ],
      "cve_ids": [
        "CVE-2023-45288"
      ],
      "fixed_version": "v0.23.0",
      "id": "GO-2024-2687",
      "packages": [
        "golang.org/x/net/http2"
      ],
      "published_at": "2024-04-03T21:12:01Z",
      "summary": "HTTP/2 CONTINUATION flood in net/http",
      "url": "https://pkg.go.dev/vuln/GO-2024-2687"
    }
  ],
  "vulnerability_count": 1,
  "vulnerability_ids": [
    "GO-2024-2687"
  ]
}
```

### Get a module

Get a Go module's latest version and when it was published, its source repository and licence, the Go version it needs, the versions its authors have retracted, whether it is deprecated, and whether a newer major version (/v2, /v3...) exists. "Latest" means what go get would choose: retracted versions are skipped.

**Inputs**

- Module path (`module`, text, required): The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.

**Outputs**

- `commit` (text)
- `deprecated` (true/false)
- `deprecation_message` (text)
- `go_version` (text)
- `is_pseudo_version` (true/false)
- `latest_version` (text)
- `licenses` (list)
- `module` (text)
- `newer_major_version` (text)
- `newer_major_version_module` (text)
- `published_at` (text)
- `redistributable` (true/false)
- `repository_url` (text)
- `retracted` (list)
- `url` (text)
- `version_count` (number)

**Example output**

```json
{
  "commit": "75de7c059e36b64f01d0dd234ff2fff404ec3374",
  "deprecated": true,
  "deprecation_message": "Use the \"google.golang.org/protobuf\" module instead.",
  "go_version": "1.17",
  "is_pseudo_version": false,
  "latest_version": "v1.5.4",
  "licenses": [
    "BSD-3-Clause"
  ],
  "module": "github.com/golang/protobuf",
  "newer_major_version": null,
  "newer_major_version_module": null,
  "published_at": "2024-03-06T06:45:40Z",
  "redistributable": true,
  "repository_url": "https://github.com/golang/protobuf",
  "retracted": [],
  "url": "https://pkg.go.dev/github.com/golang/protobuf",
  "version_count": 22
}
```

### Get a module version

Get one version of a Go module: when it was published, the commit and tag it was built from, its checksums from the Go checksum database, whether it is retracted or deprecated, and whether a newer version is out. Also gives the link to download its source.

**Inputs**

- Module path (`module`, text, required): The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.
- Version (`version`, text): Leave empty for the latest version. Pick one of the module's tagged versions, or type a branch name or commit hash.

**Outputs**

- `checksum` (text)
- `commit` (text)
- `deprecated` (true/false)
- `deprecation_message` (text)
- `go_mod_checksum` (text)
- `go_version` (text)
- `is_latest` (true/false)
- `is_pseudo_version` (true/false)
- `latest_version` (text)
- `module` (text)
- `prerelease` (true/false)
- `published_at` (text)
- `repository_url` (text)
- `retracted` (true/false)
- `retraction_reason` (text)
- `tag` (text)
- `update_available` (true/false)
- `url` (text)
- `version` (text)
- `zip_url` (text)

**Example output**

```json
{
  "checksum": "h1:sxRSkyLxlceWQiqDofxDot3d4u7DyoHPc7SBXMj8gGY=",
  "commit": "406c2bf4972d72d1746b156e5989228b094d6d3e",
  "deprecated": false,
  "deprecation_message": null,
  "go_mod_checksum": "h1:NZUaK8dAMUfzhK6uxZ+9511LtOrk73UGWOFoNvz7z+s=",
  "go_version": "1.23.0",
  "is_latest": false,
  "is_pseudo_version": false,
  "latest_version": "v1.84.0",
  "module": "google.golang.org/grpc",
  "prerelease": false,
  "published_at": "2025-07-16T18:37:53Z",
  "repository_url": "https://github.com/grpc/grpc-go",
  "retracted": true,
  "retraction_reason": "v1.74.0 was published prematurely with known issues.",
  "tag": "v1.74.0",
  "update_available": true,
  "url": "https://pkg.go.dev/google.golang.org/grpc@v1.74.0",
  "version": "v1.74.0",
  "zip_url": "https://proxy.golang.org/google.golang.org/grpc/@v/v1.74.0.zip"
}
```

### Get a package

Get a Go package from pkg.go.dev: the module it belongs to, its one-line summary, its licence, the packages it imports and how many packages and modules import it. Works for the standard library too (fmt, net/http).

**Inputs**

- Package path (`package`, text, required): The package's import path, for example golang.org/x/net/html or net/http.
- Version (`version`, text): The module version to read, for example v0.20.0. Leave empty for the latest.

**Outputs**

- `imported_by_count` (number)
- `imported_by_module_count` (number)
- `imports` (list)
- `is_command` (true/false)
- `is_latest` (true/false)
- `is_standard_library` (true/false)
- `licenses` (list)
- `module` (text)
- `name` (text)
- `package` (text)
- `redistributable` (true/false)
- `synopsis` (text)
- `url` (text)
- `version` (text)

**Example output**

```json
{
  "imported_by_count": 16083,
  "imported_by_module_count": 12900,
  "imports": [
    "golang.org/x/net/html/atom",
    "bufio",
    "bytes",
    "errors",
    "io"
  ],
  "is_command": false,
  "is_latest": true,
  "is_standard_library": false,
  "licenses": [
    "BSD-3-Clause"
  ],
  "module": "golang.org/x/net",
  "name": "html",
  "package": "golang.org/x/net/html",
  "redistributable": true,
  "synopsis": "Package html implements an HTML5-compliant tokenizer and parser.",
  "url": "https://pkg.go.dev/golang.org/x/net/html",
  "version": "v0.61.0"
}
```

### Get a vulnerability

Get a report from the Go vulnerability database by its Go id (GO-2022-0603), CVE or GitHub advisory (GHSA) id: what it is, which modules and versions it affects, where it is fixed, the affected packages and functions, and links.

**Inputs**

- Vulnerability id (`vulnerability_id`, text, required): A Go id such as GO-2022-0603, a CVE such as CVE-2022-28948, or a GHSA id.

**Outputs**

- `affected` (list)
- `aliases` (list)
- `credits` (list)
- `cve_ids` (list)
- `details` (text)
- `ghsa_ids` (list)
- `id` (text)
- `modified_at` (text)
- `modules` (list)
- `other_report_ids` (list)
- `published_at` (text)
- `references` (list)
- `review_status` (text)
- `summary` (text)
- `url` (text)
- `withdrawn_at` (text)

**Example output**

```json
{
  "affected": [
    {
      "affected_versions": "before v3.0.0-20220521103104-8f96da9f5d5e",
      "fixed_versions": [
        "v3.0.0-20220521103104-8f96da9f5d5e"
      ],
      "module": "gopkg.in/yaml.v3",
      "packages": [
        {
          "architectures": [],
          "operating_systems": [],
          "path": "gopkg.in/yaml.v3",
          "symbols": [
            "Unmarshal"
          ]
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-28948",
    "GHSA-hp87-p4gw-j4gq"
  ],
  "credits": [],
  "cve_ids": [
    "CVE-2022-28948"
  ],
  "details": "An issue in the Unmarshal function can cause a program to panic when attempting to deserialize invalid input.",
  "ghsa_ids": [
    "GHSA-hp87-p4gw-j4gq"
  ],
  "id": "GO-2022-0603",
  "modified_at": "2024-05-20T16:03:47Z",
  "modules": [
    "gopkg.in/yaml.v3"
  ],
  "other_report_ids": [],
  "published_at": "2022-08-22T18:00:47Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754"
    }
  ],
  "review_status": "REVIEWED",
  "summary": "Panic in gopkg.in/yaml.v3",
  "url": "https://pkg.go.dev/vuln/GO-2022-0603",
  "withdrawn_at": null
}
```

### Get module dependencies

Read a Go module version's go.mod file: every module it requires and at what version (marked direct or indirect), its replace and exclude rules, the versions it retracts and why, and the Go version it needs. The file itself is included too.

**Inputs**

- Module path (`module`, text, required): The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.
- Version (`version`, text): Leave empty for the latest version. Pick one of the module's tagged versions, or type a branch name or commit hash.

**Outputs**

- `dependency_count` (number)
- `deprecated` (true/false)
- `deprecation_message` (text)
- `direct_dependency_count` (number)
- `excludes` (list)
- `go_mod` (text)
- `go_version` (text)
- `godebug` (list)
- `indirect_dependency_count` (number)
- `module` (text)
- `replaces` (list)
- `requires` (list)
- `retracted` (list)
- `toolchain` (text)
- `tools` (list)
- `version` (text)

**Example output**

```json
{
  "dependency_count": 3,
  "deprecated": false,
  "deprecation_message": null,
  "direct_dependency_count": 2,
  "excludes": [],
  "go_mod": "module google.golang.org/grpc\n\ngo 1.25.0\n\nrequire (\n\tgithub.com/google/uuid v1.6.0\n\tgolang.org/x/net v0.57.0\n)\n\nrequire golang.org/x/text v0.40.0 // indirect\n\n// v1.74.0 was published prematurely with known issues.\nretract [v1.74.0, v1.74.1]\n",
  "go_version": "1.25.0",
  "godebug": [],
  "indirect_dependency_count": 1,
  "module": "google.golang.org/grpc",
  "replaces": [],
  "requires": [
    {
      "indirect": false,
      "module": "github.com/google/uuid",
      "version": "v1.6.0"
    },
    {
      "indirect": false,
      "module": "golang.org/x/net",
      "version": "v0.57.0"
    },
    {
      "indirect": true,
      "module": "golang.org/x/text",
      "version": "v0.40.0"
    }
  ],
  "retracted": [
    {
      "from_version": "v1.74.0",
      "reason": "v1.74.0 was published prematurely with known issues.",
      "to_version": "v1.74.1"
    }
  ],
  "toolchain": null,
  "tools": [],
  "version": "v1.84.0"
}
```

### List module versions

List the tagged versions of a Go module, newest first, with the date each was published and whether its authors have retracted it.

**Inputs**

- Module path (`module`, text, required): The module's path, the way you'd import it, for example github.com/gorilla/mux. A link to its repository or pkg.go.dev page works too, and so does the path of a package inside it.
- Include pre-releases (`include_prereleases`, true/false): Also list pre-release versions such as v2.0.0-rc.1. Default: `true`.
- Number of versions (`limit`, number): How many versions to return, newest first. From 1 to 100. Default: `20`.

**Outputs**

- `latest_version` (text)
- `module` (text)
- `version_count` (number)
- `version_list` (list)
- `versions` (list)

**Example output**

```json
{
  "latest_version": "v9.23.0",
  "module": "github.com/redis/go-redis/v9",
  "version_count": 67,
  "version_list": [
    "v9.23.0",
    "v9.15.0"
  ],
  "versions": [
    {
      "is_latest": true,
      "prerelease": false,
      "published_at": "2026-10-05T14:51:38Z",
      "retracted": false,
      "retraction_reason": null,
      "url": "https://pkg.go.dev/github.com/redis/go-redis/v9@v9.23.0",
      "version": "v9.23.0"
    },
    {
      "is_latest": false,
      "prerelease": false,
      "published_at": "2025-09-26T16:40:07Z",
      "retracted": true,
      "retraction_reason": "This version was accidentally released.",
      "url": "https://pkg.go.dev/github.com/redis/go-redis/v9@v9.15.0",
      "version": "v9.15.0"
    }
  ]
}
```

### List new vulnerabilities

List reports added to or changed in the Go vulnerability database since a moment you choose, most recent first, optionally only for modules under a path such as golang.org/x. Run it on a schedule to hear about new vulnerabilities in what you depend on.

**Inputs**

- Since (`since`, date and time): Only reports published or changed at or after this moment. Leave empty for the last 7 days.
- Module path (`module`, text): Only reports for this module or modules under it, for example golang.org/x. Use std for Go itself. Leave empty for every module.
- Only newly published reports (`only_new`, true/false): Leave out older reports that were only edited in the period. Default: `false`.
- Number of reports (`limit`, number): How many reports to return, most recent first. From 1 to 100. Default: `20`.

**Outputs**

- `more_available` (true/false)
- `since` (text)
- `vulnerabilities` (list)
- `vulnerability_count` (number)
- `vulnerability_ids` (list)

**Example output**

```json
{
  "more_available": false,
  "since": "2026-10-01T00:00:00Z",
  "vulnerabilities": [
    {
      "aliases": [
        "CVE-2026-97032"
      ],
      "cve_ids": [
        "CVE-2026-97032"
      ],
      "details": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.",
      "id": "GO-2026-6617",
      "is_new": true,
      "modified_at": "2026-10-08T22:31:09Z",
      "modules": [
        "stdlib",
        "golang.org/x/net"
      ],
      "published_at": "2026-10-08T22:31:09Z",
      "summary": "HTTP/2 server crash due to HPACK encoder race in net/http",
      "url": "https://pkg.go.dev/vuln/GO-2026-6617",
      "withdrawn": false
    }
  ],
  "vulnerability_count": 1,
  "vulnerability_ids": [
    "GO-2026-6617"
  ]
}
```

### List newly published versions

List module versions as they are published to the Go module mirror, oldest first, from the moment you choose, optionally only for modules under a path such as github.com/your-org. Feed Next since into the following run to see every version exactly once.

**Inputs**

- Since (`since`, date and time): Only versions published at or after this moment. Leave empty for the last hour.
- Module path (`module_prefix`, text): Only this module or modules under it, for example github.com/aws. Leave empty for every module.
- Include untagged commits (`include_pseudo_versions`, true/false): Also list pseudo-versions: commits fetched by someone without a release tag. Most of the index is these. Default: `false`.
- Number of versions (`limit`, number): How many versions to return, oldest first. From 1 to 2000. Default: `100`.

**Outputs**

- `caught_up` (true/false)
- `next_since` (text)
- `since` (text)
- `version_count` (number)
- `versions` (list)

**Example output**

```json
{
  "caught_up": true,
  "next_since": "2026-10-14T00:04:09.140479Z",
  "since": "2026-10-14T00:00:00Z",
  "version_count": 1,
  "versions": [
    {
      "is_pseudo_version": false,
      "module": "github.com/aws/aws-sdk-go-v2/service/s3",
      "prerelease": false,
      "published_at": "2026-10-14T00:04:09Z",
      "url": "https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/s3@v1.88.4",
      "version": "v1.88.4"
    }
  ]
}
```

### Search Go packages

Search pkg.go.dev for Go packages by name or topic, best match first, with each package's module, latest version, one-line summary and how many other packages import it. Use it to find the module path the other actions need.

**Inputs**

- Search for (`query`, text, required): Words to search for, for example yaml or http router.
- Number of results (`limit`, number): How many packages to return, best match first. From 1 to 100. Default: `10`.

**Outputs**

- `query` (text)
- `result_count` (number)
- `results` (list)

**Example output**

```json
{
  "query": "toml",
  "result_count": 1,
  "results": [
    {
      "imported_by_count": 38240,
      "module": "github.com/BurntSushi/toml",
      "package": "github.com/BurntSushi/toml",
      "synopsis": "Package toml implements decoding and encoding of TOML files.",
      "url": "https://pkg.go.dev/github.com/BurntSushi/toml",
      "version": "v1.6.0"
    }
  ]
}
```