An indirect comment in go.mod marks a required module that no package in your main module imports directly. It is there because one of your dependencies needs it. It is still part of your build, so a vulnerability in it can still affect you and should be scanned like any other.
Definitions
go.mod. The file that defines your module and lists required modules with minimum versions.
go.sum. A file of checksums the go command uses to verify module downloads.
Indirect requirement. A module listed in go.mod solely because a dependency needs it.
Build list. The set of module versions the go command selects for a build.
What the Go reference says
The Go modules reference defines the comment directly: it means no package from that module is imported by any package in the main module. In Go 1.17 and higher, an indirect requirement is added for every module that provides any package imported, even indirectly, by a package or test in the main module. Those lines sit in a separate block.
For this reason, a modern go.mod gives you a fairly complete view of the modules in play. The command go list with the all pattern shows the full build list with selected versions.
go list -m all
go list -m -u all
The second form adds upgrade information and marks deprecated and retracted versions.
Why scanners care
| File or command | What it tells a scanner |
|---|---|
| go.mod direct lines | Modules you chose |
| go.mod indirect lines | Modules pulled in by others |
| go.sum | Checksums that confirm content, not a full inventory |
| go list -m all | The selected versions for the whole build |
A vulnerability database such as the Go vulnerability database lists affected module paths and version ranges. Matching those ranges against the build list tells you what is exposed.
Steps to act on an indirect finding
- Run govulncheck from the module folder.
- Read the affected section first, where call stacks show your code reaching the flawed function.
- For informational findings, with no call stack, decide whether the risk is worth an upgrade now or later.
- Upgrade the module to the fixed version listed in the output.
- Run go mod tidy and re-scan.
The Go tutorial notes that upgrading to the highest fixed version in a module can clear several findings at once.
Quick check
Can I delete an indirect line to remove the dependency?
Not safely. The line reflects a real need. Run go mod tidy and let the tool maintain it.
Is an indirect module less risky?
Not by default. It runs in your binary if the vulnerable code is reached.
Safeguard reads Go module files for dependency scanning and reachability analysis. You can run a free scan.
Sources
- Go Modules Reference, go.mod and list commands
- Go tutorial, Find and fix vulnerable dependencies with govulncheck
Last reviewed: 19 October 2026.
