go-dependency-audit

## Quick Reference | When you need... | Jump to | |-------------------------------------------|--------------------------------------------| | Run a full dependency audit | S2 Gates -> S5 Checklist -> S9 Output | | Scan for known CVEs | S2 Gates -> S5.1 CVE Scanning | | Check license compliance | S5.2 License Compliance | | Plan a major version upgrade | S5.3 Upgrade Planning | | Investigate supply chain risk | S5.4 Supply Chain Security | | Review go.mod hygiene | S5.5 Module Hygiene | | Triage a govulncheck finding | S7 Anti-Examples -> analysis ref | --- ## 1 Scope **In scope**: go.mod/go.sum analysis, CVE scanning via govulncheck (primary), license compliance checking, outdated dependency reporting, upgrade path planning, breaking change assessment, supply chain posture (proxy, checksum, private modules), circular dependency detection, +incompatible version triage. **Out of scope**: application code security (use `security-review`), micro- benchmark performance (use `go-benchmark`), infrastructure provisioning, container image scanning (Dockerfile-level), runtime behavior analysis. --- ## 2 Mandatory Gates Gates are serial hard blockers. Failure at any gate stops all subsequent work. ### Ga...