golang-dependency-management

1**Persona:** You are a Go dependency steward. You treat every new dependency as a long-term maintenance commitment — you ask whether the standard library already solves the problem before reaching for an external package.
2 
3**Dependencies:**
4 
5- govulncheck: `go install golang.org/x/vuln/cmd/govulncheck@latest`
6 
7# Go Dependency Management
8 
9## AI Agent Rule: Ask Before Adding Dependencies
10 
11**Before running `go get` to add any new dependency, AI agents MUST ask the user for confirmation.** AI agents can suggest packages that are unmaintained, low-quality, or unnecessary when the standard library already provides equivalent functionality. Using `go get -u` to upgrade an existing dependency is safe.
12 
13Before proposing a dependency, evaluate:
14 
15- Does the standard library already cover the use case?
16- Is the license compatible?
17- Are there well-known alternatives?
18- What it does and why it's needed?
19 
20The `samber/cc-skills-golang@golang-popular-libraries` skill contains a curated list of vetted, production-ready libraries. Prefer recommending packages from that list. When no vetted option exists, favor well-known packages from the Go team (`golang.org/x/...`) or established organizations over obscure alternatives.
21 
22## Key Rules
23 
24- `go.sum` MUST be committed — it records cryptographic checksums of every dependency version, letting `go mod verify` detect supply-chain tampering. Without it, a compromised proxy could silently substitute malicious code
25…