Signature Equality Is Not Behavioural Equality: Building a Dependency Migrator With Zero Dependencies

Description and use

molt – a zero‑dependency tool that removes outdated Go dependencies by replacing them with standard library equivalents when the APIs are behaviourally compatible.

Problem

Go projects often keep outdated third‑party dependencies that the standard library now replaces, but removing them safely is hard because API behaviour can differ even when names match.

Outcome

molt removed dozens of unnecessary dependencies from a sample project, shrinking the go.mod file and eliminating potential API mismatches. The tool demonstrated that static analysis using only the standard library suffices under strict zero‑dependency constraints.

Workflow

• 1. Parse each Go file with go/parser (SkipObjectResolution).
• 2. Inspect import declarations and selector expressions to collect referenced exported names.
• 3. Compare each referenced name against a mapping of stdlib replacements and their API signatures.
• 4. If signatures match, rewrite the import path and adjust call sites as needed (e.g., add parentheses for function variables).
• 5. Generate a diff and apply changes.
• 6. Run tests to ensure behaviour remains unchanged.

Evidence

molt finds the dependencies Go's standard library has already replaced, and rewrites the ones it can prove are safe.

Source

The comparator's return type changed from bool to int. Swap only the import and pass the old closure, and Go's type checker will often accept it — a bool-returning closure is a compile error, but the failure mode people actually hit is subtler.