Remove every import of the module from your code, then run go mod tidy, which removes modules that provide no relevant packages. If the module stays because something else needs it, find that with go mod why and use go get module@none only when you accept the knock on effects.
The commands
From the Go managing dependencies guide:
go mod tidyedits go.mod to add necessary missing modules and remove unused modules that provide no relevant packages. With-vit prints information about removed modules.go get example.com/theirmodule@noneremoves a specific dependency, and will also downgrade or remove other dependencies that depend on the removed module.
The go.sum file is cleaned up by tidy too, which adds missing hashes and removes unnecessary ones, per the Go reference.
Steps
- Delete imports and code that use the module. Build to confirm nothing references it.
- Run
go mod tidy -vand read what it removed. - Check go.mod: the line should be gone. If not, run
go mod why -m example.com/theirmoduleto see who still needs it. - If another dependency needs it, decide whether to keep it, replace that dependency, or accept it as an indirect requirement.
- Use
go get example.com/theirmodule@noneonly if you understand the downgrades it may cause. Review the diff carefully. - Search for leftovers: vendor directory (rerun
go mod vendor), tool directives, build tags, test files and generated code. - Rebuild and rescan. Confirm the module no longer appears in your SBOM or in the binary build info.
Common reasons it will not go away
| Symptom | Likely cause |
|---|---|
| Still in go.mod after tidy | Another package imports it, or a test file does |
| Reappears after go get | A dependency requires it |
| Still listed in vendor | Vendor directory not regenerated |
| Still in the graph but not binary | Required for version selection only |
The last case is normal. A module can remain in the graph without contributing code. See which modules reach the binary.
Security reasons to prune
Each module is code you trust and a future advisory you may need to handle. Pruning unused dependencies shrinks the review surface and the list of findings. Do it as routine hygiene, for example before each release.
Where Safeguard fits
Safeguard's SBOM and dependency scanning show direct and transitive packages, so you can confirm a removal landed. Start with a free scan.
Quick check
Does go mod tidy remove unused modules?
Yes. It removes unused modules that provide no relevant packages and adds missing ones.
What does go get with @none do?
It removes the dependency and may downgrade or remove other dependencies that depend on it.
Sources
Last reviewed: 19 October 2026.
