Update Go dependencies in small steps. List what is outdated with go list -m -u all, upgrade one module with go get module@version, run go mod tidy, review the go.mod and go.sum diff, test, then rescan. Small changes make failures easy to trace and review easy to do.
The commands
From the Go managing dependencies guide:
go list -m -u alllists all dependencies with the latest available versions. For one module, usego list -m -u example.com/theirmodule.go get example.com/theirmodule@v1.3.4upgrades to a specific version.@latesttakes the newest.go getwith a commit or branch produces a pseudo-version, which you usually want to avoid in production.go mod tidyadds missing modules and removes unused ones.- Go authenticates each download, and if a module changed after publication you get a security error.
Steps
- Branch. Run
go list -m -u alland pick the modules to update, starting with ones that have security fixes. - Upgrade one module:
go get example.com/theirmodule@v1.3.4. Read its release notes first. - Run
go mod tidy. - Inspect
git diff go.mod go.sum. Expect the target module and possibly a few transitive bumps. Question anything surprising, such as a new module you did not ask for or a jump in thegoline. - Build and test:
go build ./...andgo test ./.... - Rescan for known vulnerabilities and confirm the target finding is gone.
- Open a pull request with the module, old and new versions, and the reason.
Why one at a time
| Approach | Upside | Downside |
|---|---|---|
| Upgrade everything with one command | Fast | Hard to find what broke, large review |
| One module per pull request | Easy review and rollback | More pull requests |
| Group by team or risk | Balance | Needs a convention |
Because Go uses minimal version selection, an upgrade raises only what the new version requires, which keeps diffs smaller than in ecosystems that re-resolve everything.
Watch the go line
An upgrade can raise your go directive, since a module may require a newer Go version. Since Go 1.21 that line is a mandatory minimum, and with default settings the toolchain may switch. Read what GOTOOLCHAIN does before merging such a change.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a fixed version is proposed and what the change touches.
Where Safeguard fits
Safeguard offers autonomous remediation with fix pull requests. It is off by default, with every category set to Manual, so changes need your approval. A free scan shows what is outdated.
Quick check
How do I see which modules have updates?
Run go list -m -u all.
Should I commit go.sum with an update?
Yes. Commit both go.mod and go.sum together.
Sources
Last reviewed: 19 October 2026.
