go-dependency-audit

go-dependency-audit checks Go module dependency ages and fails when modules are newer than a configured minimum age.

Features

• Checks dependency publish time via GOPROXY
• Supports direct-only or full dependency checks (including indirect)
• Handles replace directives
• Supports ignore patterns (GOPRIVATE-style)
• Supports explicit allow-list entries for specific module@version
• Supports JSON and human-readable output
• Supports diff mode against a git base ref (--base)

Requirements

• Go 1.24+
• A project with go.mod

Installation

Build locally:

go build -o go-dependency-audit .

Run without installing:

go run .

Usage

Run in a Go module directory:

go-dependency-audit [flags]

Common Examples

Check all direct dependencies:

go-dependency-audit

Check with minimum age of 7 days:

go-dependency-audit --age 7d

Include indirect dependencies:

go-dependency-audit --indirect

Ignore internal modules:

go-dependency-audit --ignore "github.com/myorg/*"

Output JSON:

go-dependency-audit --json

Check only dependencies changed from main:

go-dependency-audit --base main

Flags

• --config path to config file (default: .go-dependency-audit.json)
• --age minimum release age (examples: 3d, 72h)
• --indirect include indirect dependencies
• --ignore comma-separated module patterns to ignore
• --json output JSON format
• --concurrency number of concurrent proxy queries
• --base git ref for diff-based checks (for example main, HEAD~1)

Configuration

Default config file name:

.go-dependency-audit.json

Example:

{
  "age": "7d",
  "indirect": false,
  "ignore": ["github.com/myorg/*"],
  "json": false,
  "concurrency": 10,
  "allow": [
    {
      "module": "github.com/new-lib/foo",
      "version": "v1.2.0",
      "reason": "reviewed in PR #42"
    }
  ]
}

Allow List

Entries in allow skip the age check for an exact module@version pair.

Exit Codes

• 0: success (all checked modules pass)
• 1: policy violation (one or more modules are too new)
• 2: runtime/configuration error

CI

The repository includes GitHub Actions workflows for:

• lint/test (go vet, go test -race)
• build
• tagged releases via GoReleaser