# Cleanup Cve

> Cleans up irrelevant CVE fixes by seeking replace directives in distribution manifest.yaml files, finding the current version of the modules in the generated go.sum files, and removing replace directives where the go mod version exceeds the replacing (fixed) versions.

- Skill: `newrelic/cleanup-cve` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add newrelic/cleanup-cve`
- Raw SKILL.md: https://api.skillmd.com/api/skills/newrelic/cleanup-cve/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: newrelic (https://skillmd.com/u/newrelic)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/newrelic/cleanup-cve

---


# CVE Cleanup Skill

## Steps

### 1. Generate go.sum files

The current version of any given module comes from from the go.sum files generated by OCB. Build source files for each distribution first (even if distribution/*/_build exists, as it may be out of date):

```bash
make build
```

### 2. Seek replace directives and find current versions

We need to determine which replace directives are stale in the current version of NRDOT. Find all replaced modules and, determine if the current go.sum version exceeds the fixed version (e.g. right side of =>).

```bash
SRC_ROOT=$(git rev-parse --show-toplevel)
for distribution in "$SRC_ROOT"/distributions/*/; do
  pushd "$distribution" > /dev/null

  # Print the module and fixed (e.g. right side of =>) version for each CVE replace
  echo "=== $distribution ==="
  yq '.replaces[] | split(" => ") | .[1]' manifest.yaml 2>/dev/null | while read -r replace_directive; do
    echo "Replace Version: $replace_directive"

    module=$(echo "$replace_directive" | awk '{print $1}')
    # Filter out non-compiled dependencies
    current=$(grep "^$module" _build/go.sum | grep -v "/go.mod")
    echo "Current Version: $current"
    
  done

  popd > /dev/null
done
```

### 3. Remove replace directives

For any modules whose current versions exceed the fixed versions in the replace directive, remove those replace directives and their comments.