Review dependency changes by looking at the file that records them, then asking the same four questions in every language: what changed, where did it come from, what runs at build time, and who patches it. The files differ, the questions do not.
Which file to read in each language
| Language | Declared in | Resolved and checked in | Often missed |
|---|---|---|---|
| Go | go.mod | go.sum | replace lines, tool dependencies |
| Rust | Cargo.toml | Cargo.lock | git and path sources, build scripts |
| C++ | CMakeLists, Conan or vcpkg files | Conan lockfile or vcpkg baseline | FetchContent, submodules, vendored copies |
For Go, the modules reference explains that the go command hashes each downloaded file and compares it with go.sum, reporting a security error on mismatch. For Rust, a bare version in Cargo.toml is a caret requirement that allows compatible newer releases, so Cargo.lock holds what is actually built. See what a plain version means in Cargo.toml.
The four questions
- What changed? List added, removed and bumped packages. In Rust, a preview from cargo update dry run helps. In Go, go list with the update flag shows the gap.
- Where did it come from? Look for sources other than the default registry or proxy: a replace line in Go, a git or path source in Rust, a fetched archive or submodule in C++.
- What runs at build time? Rust build scripts and procedural macros run code. Go go:generate lines run only when someone calls them, per the go command documentation. C++ builds can run configure scripts and custom commands.
- Who patches it? A Go or Rust module is patched by a new release. A C library may be patched by your OS, a package manager, or you. See what a -sys crate means.
Pull request checklist
- The lockfile or checksum file changed together with the manifest.
- No new source outside the approved registry, proxy or recipe index.
- New packages have a clear maintainer and a reason to exist.
- Native code, whether cgo in Go, a -sys crate in Rust, or a C library, has a named version and owner. See CGO_ENABLED and dependencies.
- Tests and the advisory check pass on the resolved set.
- Anything pinned to a branch or a tag moves to a commit.
Automate what you can
Automate the file checks: a CI step that fails when go.mod changes without go.sum, or Cargo.toml without Cargo.lock. Keep the judgement questions for the reviewer.
Where Safeguard fits
Safeguard's dependency scanning, SBOM generation and PR gates cover these ecosystems in one place. The free scan at gold.safeguard.sh/scan is a quick start.
Try it yourself
Click through it at your own pace, or open it full screen.
Step through the gate and note which dependency checks would block a merge.
Quick check
Do the same checks work for all three languages?
The four questions do. The files and tools differ by ecosystem.
Which change is most often missed in review?
A source that is not the default registry, such as a Go replace line, a Rust git source, or a C++ fetched archive.
Sources
- Go Modules Reference
- go command documentation
- Cargo reference: specifying dependencies
- Cargo reference: build scripts
Last reviewed: 19 October 2026.
