Self-hosted alternatives to golang-dependency-management

G

golang-dependency-management

Dependency management for Golang projects

golang-dependency-management is an agent skill from the samber cc-skills-golang collection for managing dependencies in Go projects. It covers go.mod and go.sum, the install and upgrade flows with go get, Minimal Version Selection, and resolving conflicts between requirements. Its persona is a Go dependency steward who treats every new dependency as a long-term maintenance commitment. Its key rule is that an AI agent must ask the user for confirmation before running go get to add a new dependency, because agents can suggest packages that are unmaintained, low quality or unnecessary when the standard library already provides the same thing. The skill tells the agent to use go get -u to upgrade an existing dependency, which it treats as safe. Before proposing a new package, the agent should check whether the standard library already covers the use case, whether the licence is compatible, what the well-known alternatives are, and what the package does and why it is needed. The skill also suggests running govulncheck, installed with go install golang.org/x/vuln/cmd/govulncheck@latest, to find known vulnerabilities in the dependency tree. It is useful for teams that want to keep their dependency list small and reviewed, and for anyone whose agent has been adding libraries without asking. It is listed on skills.sh, where the page shows install counts and GitHub stars for the collection. Its security audits all pass, including Gen Agent Trust Hub, Socket and Snyk. Install it with npx skills add https://github.com/samber/cc-skills-golang --skill golang-dependency-management.