GitHub extends supply chain protections to Go modules
GitHub has announced that its suite of supply chain security features now supports Go modules. The move reflects Go's steady rise within the GitHub community, where it currently ranks among the top 15 languages on the platform. The new tooling aims to help maintainers and consumers of Go modules detect, disclose, and remediate security vulnerabilities more efficiently.
Go was created, in part, to address the problem of managing dependencies in large-scale software. GitHub is the most popular host for open-source Go modules. The features announced today will help not just GitHub users but anyone who depends on GitHub-hosted modules. We are thrilled that GitHub is investing in improvements that benefit the entire Go ecosystem, and we look forward to more collaborations with them in the future.
— Steve Francia, Product Lead: Go Language @ Google
Go modules, introduced in 2019, standardized dependency management and versioning for Go projects and have seen near-universal adoption among developers. Building on that foundation, GitHub's security features now integrate directly with go.mod files to provide visibility and automated protection throughout the software development lifecycle.
Security advisories for Go packages
GitHub's Advisory Database, an open repository of vulnerability information licensed under Creative Commons Attribution 4.0, now includes Go-specific advisories. More than 150 existing Go advisories have been published to date, with new entries added regularly as vulnerabilities are curated and triaged.
Maintainers of Go modules can leverage GitHub Security Advisories for coordinated vulnerability disclosure. The feature enables private collaboration with security researchers and other reporters to discuss and fix issues before public announcement. It also simplifies the process of requesting a Common Vulnerabilities and Exposures (CVE) identification number and publishing advisories to the National Vulnerability Database (NVD).
Dependency graph and dependency review
The dependency graph analyzes a repository's go.mod files to map its dependencies, providing the foundation for vulnerability alerts. Developers can view a repository's dependencies by navigating to the Insights tab and selecting Dependency graph from the sidebar.
This feature is enabled by default for public repositories, while private repositories require manual activation. For public repositories where the dependency graph hasn't yet been populated, the update will appear automatically; developers can expedite the process by pushing a change to their go.mod file.
When reviewing pull requests, developers can use dependency review to examine the security impact of changes to go.mod files and prevent new vulnerabilities from being introduced.
Dependabot alerts and security updates
Dependabot alerts notify developers when new vulnerabilities are found in Go modules already in use. Notifications can be tuned through the new notification configuration options to control which alerts developers receive.
Beyond alerts, Dependabot security updates generate pull requests that automatically upgrade vulnerable Go modules to patched versions. According to GitHub's 2020 security report, repositories using automated pull requests to address vulnerable dependencies patch their software 40% faster than those that don't.
Getting started
Developers can begin hardening their Go repositories today by securing their projects, or consult the documentation for each feature:
