Run go list -m -u all. It prints every module in your build list and, in brackets after the current version, the newer version that is available. Use the JSON form for scripts. It tells you what is behind, not what is vulnerable, so pair it with an advisory check.
What the command prints
The go command documentation gives an example of this output: each line names a module, its current version, and a newer version in square brackets when one exists. For tooling, the same page suggests the JSON variant, go list -m -u -json all, is more convenient to parse.
The all pattern means the main module and its dependencies, including indirect ones, so you see the whole graph that the build uses. See what indirect means in go.mod.
Reading the output
- A module with no bracket is at the newest version the proxy knows.
- A module with a bracket has a newer release. It may be a patch, a minor or a major version, so look at the number.
- Modules with a deprecated or retracted version may show extra notes. We cover those in finding deprecated modules and the retract directive.
From list to routine
| Step | Command idea | Purpose |
|---|---|---|
| Inventory | list with the update flag | See what is behind |
| Check advisories | govulncheck | See what is known vulnerable |
| Update one | go get with a version | Make a small, reviewable change |
| Verify | go build and tests | Catch breakage |
| Tidy | go mod tidy | Remove unused requirements |
Updating everything at once is hard to review. Prefer small steps, as in how to update Go dependencies safely.
Out of date is not the same as vulnerable
A module can be several versions behind and have no known issue. Another can be one patch behind and carry a serious one. Prioritise by advisory and by whether your code reaches the vulnerable function. We explain the Go approach in govulncheck reachability.
Making it a habit
Run the listing on a schedule and post only the changes to your team channel. Add the list to the pull request when a dependency changes, so reviewers see what else is available.
Safeguard's dependency scanning and reachability analysis cover Go modules, and the free scan at gold.safeguard.sh/scan shows your own results.
Try it yourself
Click through it at your own pace, or open it full screen.
Compare the full list of findings with the reachable ones, then ask which outdated modules you would update first.
Quick check
Does go list -m -u all check for vulnerabilities?
No. It reports available newer versions only. Use a vulnerability check for advisories.
How do I parse the output in a script?
Use the JSON form, go list -m -u -json all, which the documentation suggests for tools.
Sources
Last reviewed: 19 October 2026.
