GMM — Go Module Manager

GMM shows the dependencies of every go.mod in your workspace and moves them to other versions — without touching code you did not ask it to touch.

Install

code --install-extension mihaimyh.go-module-manager

Or search for GMM in the Extensions view. Marketplace page: mihaimyh.go-module-manager.

What it does

• Opens on Browse so you can search pkg.go.dev (or resolve private modules via go list -m -versions -json) and install, update, or uninstall Go modules across one or more go.mod files.
• Lists every project in the workspace and its direct and indirect dependencies under Installed, read live from the Go toolchain.
• Fills in available updates in the background, cached by the content of go.mod and go.sum, with a top-bar Include prerelease toggle.
• Shows published advisories as an amber advisory chip, and — only after you ask — the ones reachable from your own code as a red reachable chip with the symbol that reaches them.
• Updates, installs, consolidates, or removes (@none) dependencies across checked projects: one go get per project, with one level of undo.
• Runs go mod tidy only from its own confirmed button. Never after an update.
• Sends no telemetry, runs no builds or tests, and never edits .go files.

Requirements

• Go 1.21 or newer on PATH (or set gmm.goPath).
• VS Code 1.85 or newer.

Usage

1. Open a folder that contains one or more go.mod files.
2. Click the Go Modules icon in the Activity Bar to open the panel in the editor, press the GMM button in the Explorer toolbar, use the editor-title button while a go.mod is open, press Ctrl+Alt+G (Cmd+Alt+G on macOS), or run GMM: Open Go Module Manager from the Command Palette.
3. Search and install modules from Browse, or switch to Installed / Updates / Consolidate to manage workspace dependencies.
4. Select rows to update them together, or open the inspector to pick a version, check target projects, or uninstall.
5. Open Vulnerabilities and press Scan reachable for a precise check.

The precise scan runs go run golang.org/x/vuln/cmd/govulncheck@latest, so it never depends on an installed binary and always uses the current scanner. Installing the CLI is a separate, optional action.

Settings

Scope

v0.1 covers browsing, installing, reading, updating, consolidating, uninstalling, tidying and advisory checking for Go modules. Not included yet: major-version import migration and other ecosystems.

Private module paths matching GOPRIVATE / GONOPROXY are never sent to pkg.go.dev or the advisory database.

Development

npm install
npm run build     # bundles extension + webview into dist/
npm run typecheck
npm test
npm run package   # produces a .vsix
npm run install:local   # package + install into Cursor / Code / Insiders on PATH

scripts/install-local.sh checks which of cursor, code, and code-insiders are available, builds a VSIX, and installs it with --force. Reload each window afterwards.

Press F5 to launch the extension host against the fixture workspace in test/fixtures/workspace.

Publishing uses Microsoft Entra ID from a developer machine. Prefer the local release script, which bumps from the latest v* tag, requires a matching CHANGELOG.md section, commits, tags, pushes, and publishes:

az login
# Draft ## 0.1.24 (or whatever --dry-run prints) in CHANGELOG.md, then:
npm run publish:local -- --dry-run   # show the next tag
npm run publish:local                # patch bump from latest v* tag
npm run publish:local -- minor
npm run publish:local -- 0.2.0

Or by hand:

az login
npx vsce publish --no-dependencies --azure-credential

CI only attaches the VSIX to the GitHub release; global Azure DevOps PATs are retired on 2026-12-01.

Architecture: src/core is ecosystem-neutral, src/ecosystems/go holds everything Go-specific, src/extension is the VS Code host and src/webview is the panel. Decisions live in docs/adr/, vocabulary in GLOSSARY.md, scope in docs/design.md.