I’m spending some time trying to better understand best practices for Golang Modules and when used with GitHub’s Dependabot.

One practice I’m pursuing is to not (GitHub) Release Go Modules in separate repos that form part of a single application. In my scenario, I chose to not use a monorepo and so I have an application smeared across multiple repos. See GitHub help with dependency management

If a Module is not Released (on GithUb) then the go tooling versions the repo as:

I continue to be “challenged” grep’ing my Golang GitHub repos to check for module updates. I feel my code aging in cold storage and it bugs me.

Golang issues 40364: enable listing direct dependency updates includes this useful solution which filters indirect dependencies and returns a list of direct dependency updates (although presumably only 0–>1 for major versions):

go list -f '{{if not .Indirect}}{{.}}{{end}}' -u -m all

I’ll take what I can get.