Skip to content

Go#

What licenseal reads in a Go module. The rules that hold for every ecosystem are under How a scan works.

  • Registry: deps.dev for licenses, proxy.golang.org for a module's requirements
  • Manifests: go.mod (require, replace, tool directive)
  • Lockfiles: go.sum

What is read#

  • With a go.sum, the report holds its modules plus every go.mod requirement at the required version; no version is chosen among go.sum rows, so a row for another version of a module stays in the report.
  • replace directives of the scanned go.mod are applied: a requirement replaced by another module is scanned as that module. So are the replace directives of a go.work in the scanned directory, for the modules it lists with use; they override those modules' own.
  • go.work use directories are followed only when they are relative paths.

Dev dependencies#

Only a module named by a tool directive (Go 1.24+) is a dev dependency, unless a production module also requires it. // indirect is not a dev marker, and test-only requirements cannot be told from production ones.

Off-registry dependencies#

A requirement replaced by a local path the scan does not read is reported as an off-registry dependency (one it reads is the project's own code). A path written in go.work is relative to go.work.

Not evaluated#

  • replace directives in a dependency's go.mod, and a go.work below the scanned directory.
  • A go.mod with a go directive below 1.17, or none, lists direct requirements only: when one of them has no go.sum row, what it depends on is missing and the go.mod is an analysis gap; committing an up-to-date go.sum removes it.

See also#