Services

Backend Dependency Update Assessment

Backend Go dependency update assessment

Date: 2026-06-22

Baseline: docs/audits/dependency-update-baseline.md

Scope: Go module dependencies under backend/go.mod and backend/go.sum. This assessment does not change go.mod or go.sum.

Commands and evidence#

1
$ cd backend && mise exec -- go list -m -u -json all > /tmp/assistance-go-list-updates.json
2
exit: 0

Parsed summary:

1
modules with newer versions available: 49

Security-sensitive or runtime-relevant modules with updates available:

1
github.com/gin-gonic/gin v1.11.0 -> v1.12.0
2
github.com/jackc/pgx/v5 v5.6.0 -> v5.10.0
3
github.com/lib/pq v1.10.9 -> v1.12.3
4
github.com/meilisearch/meilisearch-go v0.36.1 -> v0.36.3
5
golang.org/x/crypto v0.47.0 -> v0.53.0
6
golang.org/x/net v0.48.0 -> v0.56.0
7
golang.org/x/sys v0.40.0 -> v0.46.0
8
golang.org/x/text v0.33.0 -> v0.38.0
9
golang.org/x/tools v0.40.0 -> v0.46.0
10
google.golang.org/protobuf v1.36.9 -> v1.36.11

Modules checked that are already current or had no update shown in the focused output:

1
github.com/golang-jwt/jwt/v5 v5.3.1
2
gorm.io/driver/postgres v1.6.0
3
gorm.io/gorm v1.31.1
1
$ cd backend && mise exec -- govulncheck -version
2
mise ERROR "govulncheck" couldn't exec process: No such file or directory

govulncheck is not installed in the current managed environment, so vulnerability reachability was not proven by this audit.

1
$ cd backend && mise exec -- go test ./...
2
exit: 0

Representative output:

1
ok github.com/assistance/backend/internal/auth/handler
2
ok github.com/assistance/backend/internal/auth/service
3
ok github.com/assistance/backend/internal/billing/service
4
ok github.com/assistance/backend/internal/shared/middleware

Assessment#

Yes, backend dependencies need routine update work. The current evidence does not prove an urgent reachable Go vulnerability, but it does show enough stale runtime/security-sensitive modules to justify a planned backend dependency update branch.

Prioritized update candidates#

Priority 1 — Go vulnerability tooling#

Before changing modules, add or run govulncheck through the managed toolchain.

Recommended one-off check:

1
cd backend
2
mise exec -- go run golang.org/x/vuln/cmd/govulncheck@latest ./...

If this project prefers declared tooling only, add a documented mise/Makefile task instead of relying on a developer's global binary.

Priority 2 — golang.org/x/* security-maintenance batch#

These are common security advisory targets and should be kept fresh:

1
golang.org/x/crypto v0.47.0 -> v0.53.0
2
golang.org/x/net v0.48.0 -> v0.56.0
3
golang.org/x/sys v0.40.0 -> v0.46.0
4
golang.org/x/text v0.33.0 -> v0.38.0
5
golang.org/x/tools v0.40.0 -> v0.46.0

Recommended command for a focused branch:

1
cd backend
2
mise exec -- go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/sys@v0.46.0 golang.org/x/text@v0.38.0 golang.org/x/tools@v0.46.0
3
mise exec -- go mod tidy
4
mise exec -- go test ./...

Priority 3 — HTTP/database/search runtime modules#

Candidate patch/minor updates:

1
github.com/gin-gonic/gin v1.11.0 -> v1.12.0
2
github.com/jackc/pgx/v5 v5.6.0 -> v5.10.0
3
github.com/lib/pq v1.10.9 -> v1.12.3
4
github.com/meilisearch/meilisearch-go v0.36.1 -> v0.36.3
5
google.golang.org/protobuf v1.36.9 -> v1.36.11

These touch request routing, database access, search integration, and serialization. They are reasonable routine updates, but should be verified with backend tests plus at least service build proof.

Suggested verification:

1
cd backend
2
mise exec -- go test ./...
3
make build-all

or from root:

1
mise run build:backend
2
mise run backend:test

Priority 4 — indirect cleanup#

go list -m -u all reports many indirect updates (for example bytedance/sonic, validator, goccy/go-json, quic-go, brotli, mimetype). These should usually be allowed to resolve through direct dependency updates and go mod tidy, not manually pinned one by one unless a vulnerability or compatibility issue requires it.

Recommendation#

Do update backend dependencies, but in a dedicated backend branch, not as part of a broad frontend lockfile update.

Recommended sequence:

  1. Run or add govulncheck so vulnerability reachability is known.
  2. Apply a focused golang.org/x/* security-maintenance update batch.
  3. Apply runtime module updates (gin, pgx, lib/pq, meilisearch-go, protobuf) in one or two small batches.
  4. Run mise exec -- go test ./... and mise run build:backend before merging.

No emergency backend update was proven by the commands available in this audit, but the stale golang.org/x/* and runtime modules make a planned update advisable.