GoLand 2024.2 Help

Find vulnerable and malicious dependencies

Large and complex projects usually have a number of third-party dependencies that enhance productivity by extending the functionality of common libraries and frameworks.

However, relying on third-party code raises security concerns, as it may involve the use of vulnerable dependencies in your project.

The bundled GoLand Package Checker plugin is powered by application security leader Checkmarx. The plugin analyzes dependencies for known vulnerabilities and lets you manage such cases by getting the information about a vulnerable dependency and update it to the newly released version.

Vulnerability checker

Vulnerable dependencies

Show vulnerable dependencies in the editor

  1. Open go.mod in the editor.

    The IDE highlights dependencies that are considered vulnerable.

  2. Place the caret at a highlighted dependency and press Alt+Enter to see the suggested fixes. They may suggest updating to a safe version, visiting the Checkmarx website to learn more about a particular vulnerability, or ignoring the vulnerability.

Change dependency

Analyze code to find all vulnerable dependencies

In addition, you can run an inspection to display the list of all declared and imported vulnerable dependencies in the project.

  • In the main menu, navigate to Code | Analyze Code | Vulnerable Dependencies.

The result is displayed on the Vulnerable Dependencies tab of the Problems tool window (View | Tool Windows | Problems or Alt+6) .

For each vulnerability, you can see an indication of the severity. Click a specific dependency to see more information about the vulnerabilities that were found in that dependency.

Ignore vulnerabilities

Ignored vulnerabilities are added to a list in inspection settings. If required, you can share the profile with this list with other members of your team.

  1. Open go.mod in the editor, place the caret at a highlighted dependency, and press Alt+Enter.

  2. From the list of suggestions, select Ignore vulnerable <dependency name and version>, and in the dialog that opens, select a reason for ignoring the dependency. Click Ignore.

    Ignoring vulnerability

To access the list with ignored vulnerabilities, press Ctrl+Alt+S to open the IDE settings and then select Editor | Inspections. Expand the Security node and click Vulnerable declared dependency. The list is located in the Options section in inspection details.

Learn how to share inspection profiles from Synchronize profiles between computers.

Report false positives

If you believe that a dependency identified as vulnerable is safe, you can report a false positive.

  1. Click a dependency on the Vulnerable Dependencies tab of the Problems tool window (View | Tool Windows | Problems or Alt+6) to open its description.

  2. Locate the vulnerability that you want to report and click Report false positive.

    You will see a notification with confirmation.

Report false vulnerable dependency

Malicious dependencies

The Package Checker plugin features the Malicious dependency inspection that detects malicious NPM and PyPI dependencies declared in your project. Fixing the reported problems stops your software from being compromised by an attacker.

Show malicious dependencies

  • Open a file in which NPM or PyPI dependencies are declared.

    The IDE highlights the dependencies that are considered malicious.

It is recommended that you remove the detected dependencies. Malicious dependencies data is provided by OSV.dev.

Find malicious dependencies on commit

  1. Press Alt+0 to open the Commit tool window and click Show Commit Options the Settings button.

  2. Enable the Check malicious dependencies option.

advanced commit options popup

Configure Security inspections

You can change the severity of the Security inspections, enable and disable them, and configure problem highlighting in settings.

  1. Press Ctrl+Alt+S to open settings and then select Editor | Inspections.

  2. From the options on the right, select the Security node and select the name of the inspection.

    Change the severity, scope, and highlighting as needed. Click OK to save the changes.

Last modified: 08 October 2024