The `snyk-go-plugin` package serves as a crucial plugin for the Snyk CLI, enabling it to detect and report known vulnerabilities within Golang projects. It specifically supports projects utilizing `dep` (via `Gopkg.lock`) or `govendor` (via `vendor/vendor.json`) for dependency management, as well as `go.mod` projects. The current stable version is 2.1.1, with releases occurring frequently, often monthly or bi-monthly, and sometimes more often for critical bug fixes. Its primary differentiator is its integration with the broader Snyk security platform, providing automated vulnerability scanning and remediation advice for Go applications, unlike standalone static analysis tools. It ships with TypeScript types, indicating strong support for modern JavaScript and TypeScript development workflows, and requires Node.js version 20 or higher.
npm install snyk-go-pluginVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to use the `inspect` function to programmatically scan a Go project's dependencies and output the results, including how to configure options like PackageURL generation.
If you do not wish to generate PackageURLs, you must explicitly disable this functionality by passing `{ configuration: { includePackageUrls: false } }` to the `inspect` function. Example: `inspect(cwd, 'go.mod', { configuration: { includePackageUrls: false } })`.For end-user vulnerability scanning, ensure the Snyk CLI is installed globally (`npm install -g snyk`) and use it directly. This plugin is for integrating Snyk's Go dependency resolution into custom tools or the Snyk CLI itself.
Ensure your `go.mod` file and local `replace` directives are correctly configured and resolvable within the project context. Recent versions have improved handling, but edge cases may still exist. Verify the dependency graph output from the plugin.
Upgrade your Node.js environment to version 20 or newer. Use `nvm` or a similar tool to manage Node.js versions if you need to switch between different versions.
Ensure Go is correctly installed and accessible in your system's PATH. Verify that `go mod graph` runs without errors in your project directory. Check your `go.mod` for syntax errors or unresolvable modules.
Inspect the full `result` object returned by `inspect` to understand its structure. Ensure the project path and manifest file provided to `inspect` are correct. Enable debug logging for the plugin if available to get more detailed error information.
Run `npm install` or `yarn install` again in your project to ensure all dependencies are correctly installed. Clear your `node_modules` and package manager cache if the issue persists.