Update Go Dependencies

Update all direct Go module dependencies to their latest versions, clean up the module graph, verify the build still works, and commit.

Instructions

Phase 0: Prepare

1. Confirm the working tree is clean: git status. If there are uncommitted changes, stop and ask the user how to proceed.
2. Identify all Go modules in the repo: find . -name go.mod -not -path '*/vendor/*'. Work through each module directory in turn.

Phase 1: Update dependencies

For each module directory:

1. cd into the directory.
2. Run go get -u ./... to upgrade all direct dependencies to their latest minor/patch versions.
3. Run go mod tidy to prune unused indirect deps and update go.sum.
4. If a vendor/ directory exists, run go mod vendor to sync it.

Phase 2: Verify

1. Run go build ./... — fix any compilation errors before continuing.
2. Run go test ./... — if tests fail, investigate whether the failure is pre-existing or caused by the update.
   • Pre-existing failure: note it and continue.
   • Regression from the update: attempt to pin the offending dependency to the last working version using go get <module>@<version>, then re-tidy.
3. If a linter is configured (e.g. golangci-lint, make check-style), run it and fix new issues introduced by the updated deps.

Phase 3: Summarise changes

Generate a human-readable summary of what changed:

git diff -- '*/go.mod'

Group changes by type:

• Upgraded — version bumped
• Added — new indirect dep pulled in
• Removed — dep no longer required

Phase 4: Commit

1. Stage only go.mod, go.sum, and vendor/ (if present): do not stage unrelated files.
2. Commit with a message like:

chore(deps): update Go dependencies

<paste summary of notable upgrades here>

3. Print the commit hash and ask the user if they want to push or open a PR.

Notes

• This skill upgrades to the latest version within each module's declared Go version constraint. It does not change the go directive in go.mod — use /dev-workflows:update-go-version to update the module's go directive.
• If the repo uses a replace directive in go.mod, preserve it unless the user explicitly asks to remove it.
• Security-sensitive upgrades (CVE fixes) should be called out explicitly in the commit message.