Disabling Go dependency graph data

[nickyringland]

As part of our ongoing work ensuring and improving data quality, we have run into issues with generating the Go dependency graphs. Unfortunately, our graphs for Go are not at the quality that we expect and feel confident publishing. As such, we will be disabling Go dependency graphs.

Dependency graphs are complex and especially complex when computing at an ecosystem level! We don’t currently see extensive usage of our Go dependency data, so we don’t expect this to have a major impact on our users. Historical graphs will still be available through the BQ Dataset. And, as always, please get in touch with us if you have feedback.

We are working on a new solution for providing transitive dependency information for Go modules, so stay tuned.

[hahaxixihaha]

Hi, is there any lightweight way to get downstream dependents for Go modules now that the graphs are disabled? BigQuery queries are too expensive.

For example, I’d like to check which projects depend on github.com/corazawaf/coraza/v3 at version v3.3.2.

Thanks!

[nickyringland]

@hahaxixihaha Unfortunately there's no way to do this at the moment, (other than by using the BigQuery historical data, which as you mention can be expensive to query). But we're working on bringing this functionality back, and will update here when we have more details.

[hahaxixihaha]

@hahaxixihaha Unfortunately there's no way to do this at the moment, (other than by using the BigQuery historical data, which as you mention can be expensive to query). But we're working on bringing this functionality back, and will update here when we have more details.

Ok then. Thank you very much and I'm looking forward to your good news!

[pxp928]

@nickyringland looks like the API (v3Alpha) is still responding to dependency queries. Will that also get disabled soon? Will the new solution provide API access to the dependencies also?

[NorthWindH]

Hey @nickyringland just commenting to register that I use the dependency graph data for go quite a bit, especially the "dependents" tab, when evaluating libraries. I know that I can get similar data from go.pkg.dev itself but your ui is much nicer to look through.

I know you probably have metrics to assess product decisions but I'm hoping that this comes back online soon as it was quite nice; even presenting the same data as returned by go mod graph would be great :)

[liavyona]

+1 on fixing that

[liavyona]

Also, I think it is worth updating the docs

[shanigold1]

+1 on fixing that

[OmerYa]

+1 on fixing that.