
Security News
November CVEs Fell 25% YoY, Driven by Slowdowns at Major CNAs
November CVE publications fell 25% YoY even as 2025 totals rose, showing how a few major CNAs can swing “global” counts and skew perceived risk.
goversion is a tool and library for managing semantic version bumps in your Go projects. It bumps a version.go file while creating a semantic version commit and tag.
It is intended for use with go tools that are consumed from source.
go generate can generate go code from git commits, but it's too late to capture the current git tag into src during the generate step.go tool consumes source code and not binaries.version.go before creating the version commit, tools consumed by go tool are able to introspect version data using a simple and clean workflowInstall via Go modules:
# Install go version as a tool
go get -tool github.com/bcomnes/goversion
The goversion CLI defaults to using pkg/version.go as the version file, but you can override this with the -version-file flag. Use the -file flag to specify additional files to be staged.
go tool github.com/bcomnes/goversion/cmd [flags] <version-bump>
-version-file: Path to the Go file containing the version declaration. (Default: pkg/version.go)-file: Additional file to include in the commit. This flag can be used multiple times.-version: Show the version of the goversion CLI tool and exit.-help: Show usage instructions.The <version-bump> argument can be:
Keywords for semantic bumps:
major – 1.2.3 → 2.0.0minor – 1.2.3 → 1.3.0patch – 1.2.3 → 1.2.4premajor – 1.2.3 → 2.0.0-0preminor – 1.2.3 → 1.3.0-0prepatch – 1.2.3 → 1.2.4-0prerelease – 1.2.3 → 1.2.4-0 (or bumps prerelease: 1.2.4-0 → 1.2.4-1)Special source:
from-git – use the latest Git tag (e.g. v1.2.3) as the version.Explicit version strings (must be valid semver):
1.2.3 – set exact version2.0.0-alpha.1 – set prerelease versiondev – special non-semver string that initializes the version file (used for bootstrapping)# Bump patch version (1.2.3 → 1.2.4)
goversion patch
# Bump minor version (1.2.3 → 1.3.0)
goversion minor
# Bump pre-release version (1.2.4-0 → 1.2.4-1)
goversion prerelease
# Set an explicit version
goversion 2.0.0
# Set a prerelease version
goversion 2.1.0-beta.1
# Use version from Git tag
goversion from-git
# Include README.md in the commit
goversion -file=README.md patch
# Use a custom version file path
goversion -version-file=internal/version.go minor
This command will:
-file flags).v prefix).v prefix).Note: The working directory must be clean (no unstaged/uncommitted changes outside the listed files) or the command will fail to prevent accidental commits.
You can also integrate goversion into your Go programs. For example:
package main
import (
"fmt"
"log"
"github.com/bcomnes/goversion/pkg"
)
func main() {
err := pkg.Run("pkg/version/version.go", "minor", []string{"pkg/version/version.go"})
if err != nil {
log.Fatalf("version bump failed: %v", err)
}
fmt.Println("Version bumped successfully!")
}
For detailed API documentation, visit PkgGoDev.
This project is licensed under the MIT License.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
November CVE publications fell 25% YoY even as 2025 totals rose, showing how a few major CNAs can swing “global” counts and skew perceived risk.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.