Golang

“age” defines the minimum or maximum age of a release to be considered valid.

default: empty, no age filtering.

remark:

• it accepts a duration string, such as “24h”, “7d” or “1w”.
• it cannot be combined with “vulnerability”.

“maximum” defines the maximum age a release may have to be considered.

remark:

• accepted units are “d” for days, “w” for weeks, “mo” for months and “y” for years, plus the Go duration units such as “h”, “m” and “s”.
• a unit is required.
• a month counts as 1/12 of a year and a year as 365 days.

example:

• maximum: 6mo
• maximum: 1y

“minimum” defines the minimum age a release must have to be considered.

remark:

• accepted units are “d” for days, “w” for weeks, “mo” for months and “y” for years, plus the Go duration units such as “h”, “m” and “s”.
• a unit is required.
• a month counts as 1/12 of a year and a year as 365 days.

example:

• minimum: 24h
• minimum: 7d
• minimum: 3w

“ignore” defines rules to exclude matching Go modules or Go versions from the autodiscovery.

remark:

• a Go module or Go version is ignored when it matches at least one rule.

“goversion” defines a Go version constraint to match.

remark:

• the value must be a valid semantic version constraint.
• when unset, any Go version matches.

example:

• goversion: “1.19.*”
• goversion: “>=1.20.0”
• goversion: “<1.20.0”
• goversion: “*”

“modules” defines the Go modules to match, keyed by module name.

remark:

• the key is a regular expression matched against the module name.
• the expression is not anchored, so it also matches module names that contain it.
• an empty value matches any version.
• otherwise the value is a semantic version constraint, such as “>=1.0.0”.
• when the version or the constraint cannot be parsed, the value must equal the version.
• the Go version entry has no module name, so “modules” is not checked for it. A rule that sets only “modules” therefore also matches the Go version.

example:

• “github.com/updatecli/updatecli”: "" matches any version of the module.
• “github.com/updatecli/updatecli”: “1.0.0” matches only version 1.0.0 of the module.
• “github.com/updatecli/updatecli”: “>=1.0.0” matches version 1.0.0 or later of the module.
• “github.com/.*”: “>=1.0.0” matches version 1.0.0 or later of any module hosted on github.com.

“path” defines a go.mod path pattern.

remark:

• the pattern must match the whole path, not just a substring.
• the pattern follows the Go filepath.Match syntax, such as “*” or “?”.

example:

• path: go.mod
• path: “*/go.mod”

“replace” defines whether the module must come from a replace directive.

default: unset, any module matches.

remark:

• true matches only modules with a replace directive.
• false matches only modules without a replace directive.

“only” defines rules to restrict the autodiscovery to matching Go modules or Go versions.

remark:

• a Go module or Go version is kept only when it matches at least one rule.
• when every rule sets “goversion” without “modules”, only the Go version is updated.
• when every rule sets “modules” without “goversion”, only the Go modules are updated.

“goversion” defines a Go version constraint to match.

remark:

• the value must be a valid semantic version constraint.
• when unset, any Go version matches.

example:

• goversion: “1.19.*”
• goversion: “>=1.20.0”
• goversion: “<1.20.0”
• goversion: “*”

“modules” defines the Go modules to match, keyed by module name.

remark:

• the key is a regular expression matched against the module name.
• the expression is not anchored, so it also matches module names that contain it.
• an empty value matches any version.
• otherwise the value is a semantic version constraint, such as “>=1.0.0”.
• when the version or the constraint cannot be parsed, the value must equal the version.
• the Go version entry has no module name, so “modules” is not checked for it. A rule that sets only “modules” therefore also matches the Go version.

example:

• “github.com/updatecli/updatecli”: "" matches any version of the module.
• “github.com/updatecli/updatecli”: “1.0.0” matches only version 1.0.0 of the module.
• “github.com/updatecli/updatecli”: “>=1.0.0” matches version 1.0.0 or later of the module.
• “github.com/.*”: “>=1.0.0” matches version 1.0.0 or later of any module hosted on github.com.

“path” defines a go.mod path pattern.

remark:

• the pattern must match the whole path, not just a substring.
• the pattern follows the Go filepath.Match syntax, such as “*” or “?”.

example:

• path: go.mod
• path: “*/go.mod”

“replace” defines whether the module must come from a replace directive.

default: unset, any module matches.

remark:

• true matches only modules with a replace directive.
• false matches only modules without a replace directive.

“onlygomodule” restricts the autodiscovery to the Go modules defined in go.mod.

default: false

“onlygoversion” restricts the autodiscovery to the Go version defined in go.mod.

default: false

remark:

• it cannot be combined with “vulnerability”.

“rootdir” defines the directory where the crawler starts searching for go.mod files.

default: the scm directory when “scmid” is set, otherwise the directory relative paths resolve from, by default the working directory.

remark:

• a relative path is resolved from the default directory.
• an absolute path is used as is, instead of the scm directory.

“versionfilter” defines the version filter used by the generated manifests.

default: kind “semver” with pattern “*”, any version greater than or equal to the current one.

remark:

• with kind “semver”, “pattern” accepts:
  • “prerelease”: the latest prerelease of the current version.
  • “patch”: patch updates only.
  • “minor”: patch and minor updates.
  • “minoronly”: minor updates only.
  • “major”: patch, minor and major updates.
  • “majoronly”: major updates only.
  • a version constraint, such as “>= 1.0.0”.
• with kind “regex”, “pattern” accepts a regular expression.
• more examples at https://www.updatecli.io/docs/core/versionfilter/
• a module using a pseudo version ignores the filter and is updated to the latest version.
• it cannot be combined with “vulnerability”.

example:

versionfilter:
  kind: semver
  pattern: minor

“kind” defines the versioning scheme used to select a version.

default: latest

remark:

• accepted values are “latest”, “semver”, “regex”, “regex/semver”, “time”, “regex/time”, “lex” and “pep440”.
• “latest” returns the last version of the list.
• “lex” sorts the versions lexicographically and returns the last one.
• “pep440” follows https://peps.python.org/pep-0440/

example:

• kind: semver

“pattern” defines the version pattern, according to “kind”.

default:

• latest: “latest”
• semver and pep440: “*”
• regex: “.*”
• time and regex/time: “2006-01-02”

remark:

• for “latest”, “latest” returns the last version, any other value must match a version exactly.
• for “semver” and “regex/semver”, it is a semantic versioning constraint.
• for “pep440”, it is a pep440 version specifier.
• for “regex”, it is a regular expression.
• for “time” and “regex/time”, it is a Go date layout.
• ignored by “lex”.

example:

• pattern: ~1.2
• pattern: “>=1.0.0 <2.0.0”
• pattern: ^v\d+.\d+.\d+$

“regex” defines the regular expression extracting the version from each entry.

remark:

• only used by the kinds “regex/semver” and “regex/time”.
• the value of the first capture group is used as the version.

example:

• regex: ^v(\d+.\d+.\d+)$

“replaceall” applies a regular expression replacement to each version before filtering.

remark:

• only used by the kinds “regex”, “regex/semver” and “regex/time”.
• the replacement runs before “pattern” or “regex” is evaluated.

example:

replaceall:
  pattern: "_"
  replacement: "."

turns “curl-8_15_0” into “curl-8.15.0”.

“pattern” defines the regular expression matching the text to replace.

example:

• pattern: “_”

“replacement” defines the text replacing each match of “pattern”.

remark:

• capture groups can be referenced with $1, $2, and so on.

example:

• replacement: “.”

“strict” enforces strict semantic versioning rules when parsing versions.

default: false

remark:

• only used by the kinds “semver” and “regex/semver”.

“vulnerability” switches the autodiscovery to security updates, based on the OSV database (https://osv.dev).

Each Go module is updated to the lowest version without known vulnerabilities, and left untouched when it has none.

remark:

• only security updates are generated, routine updates require a separate manifest.
• it cannot be combined with “age”, “versionfilter” and “onlygoversion”.
• the Go version and indirect modules are not covered.
• labels, such as “security”, are set on the action used by the manifest.

example:

vulnerability:
  minseverity: high
  ignore:
    - GO-2025-3503

“ignore” defines the vulnerability IDs or aliases to disregard.

example:

ignore:
  - GO-2025-3503
  - GHSA-cpwx-vrp4-4pq7
  - CVE-2025-27516

“minseverity” defines the minimum severity of the vulnerabilities to account for.

remark:

• accepted values are “LOW”, “MODERATE”, “HIGH” and “CRITICAL”, in any case.
• “MEDIUM” is accepted as an alias of “MODERATE”.
• the severity comes from GitHub advisories. Vulnerabilities without one are always accounted for.

example:

• minseverity: HIGH

“strategy” defines the version a vulnerable dependency is updated to.

default: lowest

remark:

• the only accepted value is “lowest”: the lowest version without known vulnerabilities.
• the value is case insensitive.

“url” defines the OSV API URL.

default: https://api.osv.dev