Go
Review Go source code and binary scanning support in JFrog Xray.
Introduction
JFrog Xray provides security and compliance analysis for Go applications throughout the software development lifecycle. This page describes the supported scan contexts, capabilities, and dependency analysis available for Go.
Capabilities
The following capabilities are available for Go.
| Capability | Source Code Scanning | Binary Scanning |
|---|---|---|
| Vulnerability Matching (CVEs) |  | |
| License Detection | | |
| Malicious Package Detection | |  |
| Operational Risk | | |
| Smart Remediation | 🔜 | 🔜 |
Source code scanning analyzes your project's dependency manifest files to identify components and their vulnerabilities. You can use it with the JFrog CLI jf audit command, Frogbot, IDE integrations, and CI pipelines. For more information, see Scan Your Source Code.
Which files a source scan reads depends on the scan method. For those differences, see Source Scanning Engines and Frogbot Versions.
Supported Files
| Package Manager | Supported Files | Available with |
|---|---|---|
| Go Modules | go.mod, go.sum (required) | Default jf audit |
| Go Modules | go.mod, go.sum – Direct/indirect via // indirect comments, replace directives honored, stdlib detection, Go 1.11+ | Frogbot V3 |
Dependency Graph
| Package Manager | Dependency Graph |
|---|---|
| Go Modules | ⚠️ Flat Dependency list |
Binary scanning analyzes built artifacts stored in JFrog Artifactory repositories, extracting package metadata from the artifact format itself. For more information, see Scan Your Binaries.
Supported Files
The following files are supported for Go binary scanning.
| Package Manager | Supported Files |
|---|---|
| Go | Go module archives |
Additional Information
- Go source code scanning requires Go installed in your environment.
- The
go.sumfile must be present for accurate dependency scanning. - You can run
go mod tidyto ensure all dependencies are correctly listed.
Related Topics
Updated 26 days ago