vulnfix consumes govulncheck -json output and applies dependency fixes to a Go module.
It is designed for a simple workflow:
- run
govulncheck -json - pipe the output to
vulnfix - let
vulnfixupdate vulnerable modules and tidy the module graph
go install github.com/hamba/vulnfix@latestgovulncheck -json ./... | vulnfixRun in a different module directory:
govulncheck -json ./... | vulnfix -C /path/to/moduleYou can also apply fixes from a saved report:
vulnfix < govulncheck-report.jsonOptionally write a Markdown CVE report:
govulncheck -json ./... | vulnfix -o report.mdvulnfix parses the govulncheck -json output and collects the minimum fixed
version for each vulnerable module. It then runs go get <module>@<version> for
each affected dependency and follows up with go mod tidy to keep the module
graph clean.
Special pseudo-modules are handled automatically:
| Module | Action |
|---|---|
stdlib |
Updates the go directive via go get go@<version> |
toolchain |
Updates the toolchain directive via go get toolchain@<version> |
| everything else | Regular go get <module>@<version> |