A go.mod file tells you what your project depends on. It cannot tell you which of those dependencies the standard library has already made unnecessary.
That gap is bigger than it sounds. Go 1.13 shipped %w and github.com/pkg/errors became largely redundant. Go 1.21 shipped slices, maps, cmp and log/slog. Go 1.22 taught net/http.ServeMux method and wildcard routing. Go 1.27 shipped uuid. Every one of those releases quietly demoted a package that thousands of go.mod files still require.
Almost nobody goes back and removes them. Not out of laziness — because doing it safely means auditing which symbols you actually use, and whether the standard library's version really behaves the same. That's mechanical, tedious, high-stakes work. So I built a tool for it, for the Zero Dependency Hackathon 2026, Track A.
I went in believing this was an import-rewriting problem.
I was wrong, and the way I was wrong is the interesting part.
