govulncheck-apply

README

govulncheck-apply

Reads a govulncheck -json stream on stdin and applies the reported fixes to the go.mod(s) in the working directory: upgrades vulnerable modules and bumps the go directive for standard-library vulns.

Usage

go install github.com/netflix-skunkworks/govulncheck-apply@latest
govulncheck -json ./... | govulncheck-apply

Reproduce a test scenario

internal/cmd/repro extracts an internal/testcases/*.txtar scenario into a temp dir:

go run ./internal/cmd/repro -testcase vuln_xtext
cd <dir>
./govulncheck -db file://<dir>/govulncheck-db -json ./... | ./govulncheck-apply

Documentation

Overview

Command govulncheck-apply reads a `govulncheck -json` stream on stdin and applies the identified fixes to the `go.mod`s in your working directory.

govulncheck -json ./... | go tool github.com/netflix-skunkworks/govulncheck-apply

Copyright 2026 Netflix, Inc.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.