Finding unmaintained dependencies is the easy part. Removing them is where it gets hard.

This is the story of how we slimmed down vuls , the open-source vulnerability scanner I created — what didn't work, what did, and the tooling we built after doing it all by hand.

The easy win: 15 minutes

mitchellh/go-homedir has been archived for years. Vuls used it in a couple of lines in two source files:

- import "github.com/mitchellh/go-homedir" - dir, err := homedir.Dir() + dir, err := os.UserHomeDir()

Enter fullscreen mode

Exit fullscreen mode

Fifteen minutes, start to finish. The standard library has done this since Go 1.12.

Trivy used the same package, so we sent them a similar fix . The Trivy maintainers reviewed and merged it within three weeks.

We felt good. Let's keep going.

The part where almost nothing happened

We kept going. Over two weeks we replaced 9 direct dependencies with standard-library code or a few lines of our own.…