A pseudo-version is Go's version string for a specific commit that has no semantic version tag. It encodes a base version, a UTC timestamp and a 12 character commit hash. It is reproducible, but it signals unreleased code, so treat it as a debt to repay with a tagged release.
How to read one
The Go reference lists three forms. The most common for a module with releases looks like this:
v1.2.4-0.20191109021931-daa7c04131f5
| Part | Meaning |
|---|---|
| v1.2.4-0 | Base: the next patch after the latest tagged release |
| 20191109021931 | UTC time of the revision (commit time in Git) |
| daa7c04131f5 | 12 character commit hash prefix |
Go checks these parts. A base version needs a tagged ancestor, the timestamp must match the revision, and the revision must be an ancestor of a branch or tag in the repository.
How you end up with one
Run go get example.com/mod@bugfixes or @4cf76c2 and the go command translates the branch or hash into a pseudo-version in your go.mod. The Go documentation uses this for testing commits before version tags exist.
Is it safe?
The commit hash pins the content, so the build is reproducible and the checksum database still covers it like any other version. The risks are about maintenance, not integrity:
- No release process stood behind that commit. Nobody promised it is stable.
- Fixes are harder to track, because advisories usually reference tagged versions.
- Tools that compare versions to advisory ranges can misjudge a commit between tags.
- A pseudo-version often points at a fork or a fix branch that may never be merged.
Decision guide
- Is there a release that includes the commit? Move to it with
go get example.com/mod@v1.3.0. - If not, ask the maintainer for a tag, and note the issue link in your pull request.
- If you must keep the pseudo-version, record why in a comment and set a review date.
- List all pseudo-versions in your project and check how old each is: look for the timestamp in the string, which gives you the age at a glance.
You can list every module version with go list -m all and filter for versions containing a long digit run.
Where Safeguard fits
Safeguard's dependency scanning and SBOM output record the exact module versions in use, including pseudo-versions, and policies can gate on findings. A free scan will show your inventory.
Quick check
Does a pseudo-version point to a fixed commit?
Yes. The last part is a 12 character commit hash prefix, and Go validates the timestamp against the revision.
Can I read the commit date from it?
Yes. The middle part is the UTC timestamp of the revision.
Sources
Last reviewed: 19 October 2026.
