Dependency Scanning with govulncheck & SBOM

Go modules plus govulncheck give you a first-class supply-chain signal in CI, while SBOM export answers auditors and security teams asking what ships in each binary.

Treat vulnerability scanning as a gate, not a one-time checkbox.

Summary

Your service imports dozens of transitive modules.

The Go vulnerability database records CVEs affecting standard library and third-party packages.

govulncheck analyzes which imported symbols are actually reachable from your code and reports relevant findings.

SBOMs (Software Bill of Materials) list components and versions for compliance, license review, and faster incident triage when a new CVE lands.

Pair scanning with go mod tidy, pinned CI Go versions, and a patch SLA.

Recipe

Quick-reference recipe card - copy-paste ready.

go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

When to reach for this:

• Every CI pipeline on merge and release tags.
• Before promoting containers to production registries.
• After Dependabot or manual module bumps to confirm findings cleared.
• Compliance programs requiring SBOM attachment per artifact.

Working Example

#!/usr/bin/env bash
set -euo pipefail
 
# CI job excerpt for example.com/myapi
export GOTOOLCHAIN=local
go version
go mod download
go mod verify
 
echo "== govulncheck =="
govulncheck -json ./... > govulncheck.json
# Fail on any finding in CI (tune with allowlist file if needed)
if jq -e '.finding | length > 0' govulncheck.json >/dev/null 2>&1; then
  echo "vulnerabilities found"
  jq '.finding' govulncheck.json
  exit 1
fi
 
echo "== SBOM (CycloneDX) =="
go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
cyclonedx-gomod mod -json -output sbom.json

// main.go - minimal module for scanning demos
package main
 
import (
    "encoding/json"
    "net/http"
)
 
func main() {
    http.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
        json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
    })
    http.ListenAndServe(":8080", nil)
}

What this demonstrates:

• go mod verify confirms go.sum entries match downloaded modules.
• govulncheck -json output suitable for CI parsing and dashboards.
• Failing the build when findings exist (policy choice).
• CycloneDX SBOM generation from the module graph for artifact storage.

Deep Dive

How It Works

• go mod resolves require directives into a module graph recorded in go.sum.
• Proxy downloads (GOPROXY) serve zip hashes; tampering breaks verification.
• govulncheck performs static analysis to see if vulnerable functions are called from your packages, reducing noise versus naive CVE scanners.
• SBOM tools (cyclonedx-gomod, syft) emit JSON listing modules, versions, and hashes for attachment to container images or release pages.
• Container builds should run scans on the same go.mod commit baked into the image tag.

CI Pipeline Stages

Handling Findings

Go Notes

# Pin toolchain in go.mod for reproducible CI
# go.mod line: go 1.26
 
# Private modules
export GOPRIVATE=github.com/myorg/*
export GONOSUMDB=github.com/myorg/*

Gotchas

• Skipping govulncheck because go.sum exists - Checksums prove integrity, not absence of known CVEs.
• Only scanning direct requires - Transitive modules introduce most findings; scan ./... at package level.
• Ignoring stdlib vulnerabilities - Go release notes include security fixes; old patch versions stay vulnerable.
• SBOM generated once manually - Drift from CI makes audit artifacts stale. Generate per build from locked go.sum.
• replace directives to unvetted forks - replace bypasses normal provenance; review like first-party code.
• GONOSUMDB too broad - Disabling sum verification for whole domains removes tamper detection.
• Green scan without upgrading - govulncheck may report no reachable vulns on an old version until symbols change; still bump per release policy.

636f64656775696465732e696f7c6367696f3436397c323032363037

Alternatives

FAQs

Related

• Go Security Basics - local govulncheck command
• Security for Go Services: Defaults and Gaps - supply chain in the security model
• Go Toolchain Basics - module and build commands
• CI Quality Gates: Lint, Test, Race & Vuln - CI quality gates alongside security
• Security Best Practices Summary - dependency scanning checklist items

Stack versions: This page was written for Go 1.26.x (Green Tea GC default, go fix modernizers - verify patch at build), chi (latest - verify at build), gin (latest - verify at build), echo (latest - verify at build), google.golang.org/grpc (latest - verify at build), sigs.k8s.io/controller-runtime (latest - verify at build), kubebuilder (latest - verify at build), tinygo (latest - verify board targets at build), wazero (latest - verify at build), and golangci-lint (latest - verify at build).