go mod tidy

[xushiwei]

No description provided.

[gemini-code-assist]

Code Review

This pull request removes all dependencies from the go.mod file and deletes the go.sum file. A critical issue was identified where these deletions, likely caused by using the standard go mod tidy instead of gop mod tidy in a Go+ project, will lead to build failures because essential dependencies like pflag are no longer tracked.

I am having trouble creating individual review comments. Click here to see my feedback.

go.mod (5-10)

The go mod tidy command has removed all dependencies, including github.com/spf13/pflag, which is essential for Cobra. This typically occurs in Go+ projects when using the standard go tool instead of the gop tool, as go mod tidy does not scan .gop files for imports. This will likely cause build failures. It is recommended to use gop mod tidy to correctly manage dependencies in a Go+ project.

[fennoai]

Code Review: go mod tidy

The structural changes here appear correct for this repo's layout: pflag and mousetrap are vendored in-tree as local sub-packages (not external modules), so they don't need require entries. go-md2man and go.yaml.in/yaml/v3 are only used by the doc/ sub-module which has its own go.mod. The .github/workflows/test.yml change (removing version: latest) is a minor improvement — golangci-lint-action@v8.0.0 bundles its own linter binary, so fetching latest on every run was an unnecessary slow network download.

One concern worth addressing:

go.sum / go.mod — Vulnerability scanner blind spot

Removing the require block and clearing go.sum means tools like Dependabot, Snyk, and govulncheck will no longer have a machine-readable record of the vendored dependency versions (pflag v1.0.9, mousetrap v1.1.0, etc.). If a CVE is disclosed against one of those packages, automated alerts won't fire.

Consider either:

1. Keeping minimal require + go.sum entries for the vendored packages so scanners can track them, or
2. Documenting the vendored package versions in a SECURITY.md or code comment so they remain visible for manual auditing.

[fennoai]

Clearing go.sum removes cryptographic hash verification for the previously tracked vendored dependencies. Even in a fully-vendored repo, keeping go.sum enables go mod verify and ensures security scanners (Dependabot, OSV-Scanner) can detect CVEs in vendored package versions like pflag v1.0.9 and mousetrap v1.1.0.