Dependabot-based dependency graphs for Go

Source: GitHub Changelog

Dependabot DGS for Go

Continuing the supply‑chain‑security theme of continually improving our package‑ecosystem support, Go projects will now see more complete and accurate transitive dependency trees in their dependency graphs and Software Bill of Materials (SBOMs).

Dynamic version resolution

Since Go resolves dependency versions dynamically, getting an accurate picture of a project’s dependencies cannot rely on static parsing.

New Dependabot job

When a commit updates a project’s go.mod, GitHub runs a new type of Dependabot job that:

1. Builds a dependency snapshot.
2. Uploads the snapshot to the Dependency Submission API.

Benefits

• No action‑minute charges – the process does not incur costs for GitHub Actions minutes.
• Organization‑wide configuration – the job can access private‑registry settings you’ve configured for Dependabot across the organization.

Learn more

For additional details, see the documentation on Configuring the dependency graph.