Go packages data is old

I noticed that go packages data is old, so there are many packages with missing versions. I'm using osv-scanner for license scanning, so when updating a package to latest version, in case it's missing on deps.dev the license will not be identified, which causes the scan to fail:

We can add license override to overcome this, but it requires a lot of maintenance effort.
Can you update go packages data more frequently?

Related issues: #120 #146

Any progress on this?

Eg https://pkg.go.dev/golang.org/x/oauth2 has two versions released since new years, v0.25.0 and v0.26.0

non of them is found at deps.dev at the moment. The latest being v0.24.0

https://deps.dev/go/golang.org%2Fx%2Foauth2

👋 I also ran into this issue today for golang.org/x/oauth2@v0.30.0 which has no license information available, but it has a BSD-3-Clause license: https://pkg.go.dev/golang.org/x/oauth2@v0.30.0?tab=licenses

Any updates on this? All these versions of packages are missing:

cloud.google.com/go/auth/oauth2adapt v0.2.7
cloud.google.com/go/auth v0.14.1
cloud.google.com/go/compute/metadata v0.3.0
cloud.google.com/go/compute/metadata v0.6.0
cloud.google.com/go/iam v1.4.0
cloud.google.com/go/monitoring v1.24.0
cloud.google.com/go/storage v1.50.0
cloud.google.com/go v0.118.3
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c
github.com/apache/arrow/go/arrow v0.0.0-20211112161151-bc219186db40
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30
github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42
github.com/oasdiff/yaml3 v0.0.0-20241214160948-977117996672
github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90
github.com/oasdiff/yaml v0.0.0-20241214135536-5f7845c759c8
github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037
github.com/urfave/cli/v3 v3.0.0-beta1
github.com/wiremock/wiremock-testcontainers-go v1.0.0-alpha-9
github.com/xuri/efp v0.0.0-20250227110027-3491fafc2b79
github.com/xuri/nfp v0.0.0-20250226145837-86d5fc24b2ba
golang.org/x/oauth2 v0.26.0
golang.org/x/text v0.22.0
golang.org/x/text v0.23.0
golang.org/x/text v0.24.0
golang.org/x/text v0.25.0
google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422
google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb
google.golang.org/genproto/googleapis/rpc v0.0.0-20250204164813-702378808489
google.golang.org/genproto/googleapis/rpc v0.0.0-20250311190419-81fb87f6b8bf
google.golang.org/genproto/googleapis/rpc v0.0.0-20250407143221-ac9807e6c755
google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8
github.com/gomarkdown/markdown v0.0.0-20250202022148-4f606c78d442
github.com/lufia/plan9stats v0.0.0-20250303091104-876f3ea5145d

and some that are there, but with an unknown license even though there's a standard license file in the repo:

github.com/golang-plus/errors v1.0.0 -- license
github.com/golang-plus/testing v1.0.0
github.com/golang-plus/uuid v1.0.0
github.com/modfin/jct v0.0.0-20190320142916-e0e6f4d19880
github.com/modfin/wsrpc v0.0.0-20200925131019-ba4063673426

@cuixq

cc @cuixq, @distractible would either of you have any context to share?

Hi folks, we’re happy to report that we have now swapped over to our new Go data processing pipeline, which has resolved these missing Go modules issues, please see below:

Please let us know if you have any feedback on the new data!

Cheers!

Navigation Menu

Repository navigation

Go packages data is old #147

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Go packages data is old #147

Description

Activity

crholm commented on Feb 7, 2025

picatz commented on May 6, 2025

modfinmarwi commented on May 8, 2025

picatz commented on May 9, 2025

machi-genggeng commented on Jul 9, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions