EcosystemGo Modules
Go Modules Scanner
Deptic analyzes go.mod and go.sum files to identify direct and indirect dependencies. Go's Minimal Version Selection (MVS) algorithm is respected when determining the final resolved versions.
Manifest files detected:
| File | Priority | Notes |
|---|---|---|
go.mod | High | Primary module file |
go.sum | High | Checksums and exact version locking |
Indirect dependencies:
Go includes // indirect markers in go.mod. Deptic treats these as transitive dependencies in the SBOM generation to ensure NTIA compliance.
PURL format for Golang:
pkg:golang/github.com/gin-gonic/gin@v1.9.1Note: The prefix is golang (not go) according to the official PURL specification.
Known limitations:
- Replaced modules (
replace github.com/x/y => ../z) pointing to local paths are omitted from the vulnerability scan as they cannot be queried remotely