macOS
Homebrewverified · 100%
brew install staticchecklocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install staticcheckMacPorts ports tree · devel/staticcheck/Portfile · source: api.github.com
brew
Install staticcheck with Homebrew, apk, dnf, MacPorts, pacman, scoop
State of the art linter for the Go programming language. Version 2026.1 via Homebrew; verified 2026-07-08.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add staticcheckAlpine Linux edge package indexes · staticcheck · source: dl-cdn.alpinelinux.org
Fedora dnfverified · 92%
sudo dnf install staticcheckFedora Rawhide package metadata · staticcheck · source: dl.fedoraproject.org
Arch Linux pacmanverified · 92%
sudo pacman -S staticcheckArch Linux sync databases · staticcheck · source: geo.mirror.pkgbuild.com
Windows
Scoopverified · 92%
scoop install main/staticcheckScoop official bucket manifest trees · bucket/staticcheck.json · source: api.github.com
overview
Package summary
State of the art linter for the Go programming language
Project links
Commands and aliases
- staticcheck
history
Project history and usage
Staticcheck is a Go static-analysis command-line tool and one of the best-known third-party linters in the Go ecosystem. It is packaged as the `staticcheck` executable and is commonly installed with Go tooling or system package managers for local development and CI.
Project history
The upstream project lives in Dominik Honnef's `go-tools` repository, which was created in January 2017. The official README describes Staticcheck as an advanced Go linter that finds bugs and performance issues, offers simplifications, and enforces style rules.
Staticcheck publishes release notes on staticcheck.dev. The release-note index records releases from 2017.2 through the 2026 series, showing a long-running tool with versioned compatibility work alongside Go's release cadence.
Adoption history
The input package metadata lists Staticcheck in Homebrew, Alpine, Fedora, MacPorts, Arch, and Scoop. The official documentation also recommends installing released versions with `go install honnef.co/go/tools/cmd/staticcheck@latest` on modern Go versions or using prebuilt binaries from GitHub releases.
Staticcheck's package-manager footprint reflects its role as a standard quality gate for Go projects. It is useful as a standalone CLI, as a CI check, and as a linter that complements the Go compiler and `go vet`.
How it is used
Typical usage is to run `staticcheck` against Go packages or wire it into CI. The tool can analyze code targeting Go versions up to the latest release, while the project recommends using tagged releases instead of master for stable builds.
Why package nerds care
Package nerds care about Staticcheck because it is a canonical example of a language ecosystem tool that lives outside the core toolchain but is widely treated as infrastructure. Its version tags, prebuilt binaries, and `go install` path make it straightforward to pin in reproducible builds.
For package managers, Staticcheck is high-value despite being a single executable: it is heavily used by Go developers, has stable release notes, and represents the broader `honnef.co/go/tools` analyzer collection.
Timeline
- 2017: `dominikh/go-tools` repository created.
- 2017: Staticcheck 2017.2 release published.
- 2019: Staticcheck 2019.2 release notes described major performance and memory improvements.
- 2026: Staticcheck 2026.1 and 2026.2 release candidates appeared in official releases.
Related projects
- The same repository contains related tools such as `structlayout`, `structlayout-optimize`, and `structlayout-pretty`, and libraries used to implement the tools.
Sources
security posture
Risk level: yellow
generalized runtime or code generation signal.
Risk classifier
yellow risk · medium confidence · runtime
Why
- generalized runtime or code generation signal
Signals
- text:programming language
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Installs with 1 runtime dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
staticcheck.conf- Windows
staticcheck.conf
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
staticcheck | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version2026.1
manager updated2026-07-08
local dataok
upstreamcurrent
latest detected2026.1
https://github.com/dominikh/go-tools
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:staticcheck |
|---|---|
| Version | 2026.1 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/staticcheck |
| Homepage | https://staticcheck.dev/ |
| Repository | https://github.com/dominikh/go-tools |
| Upstream docs | https://staticcheck.dev/docs |
| License | MIT |
| Source archive | https://github.com/dominikh/go-tools/archive/refs/tags/2026.1.tar.gz |
| Last updated | 2026-07-08T03:14:15Z |
| Pulse | updated |
| Dependencies | go |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | staticcheck |
| Version Scheme | 0 |
| Revision | 5 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
apk95%
staticcheck 2026.1-r3
advanced Go linter
https://github.com/dominikh/go-tools
sudo apk add staticcheck- License: MIT
- Architecture: x86_64
- Source Package: staticcheck
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Staticcheck
dnf95%
staticcheck 2026.1-1.fc45
The advanced Go linter
https://github.com/dominikh/go-tools
sudo dnf install staticcheck- License: BSD-3-Clause AND MIT
- Category: Unspecified
- Architecture: x86_64
- Source Package: staticcheck
- 3 dependencies
- 2 provides
- normalized package name match
- Matched by: Staticcheck
pacman95%
staticcheck 2026.1-3
The advanced Go linter
sudo pacman -S staticcheck- License: MIT
- Architecture: x86_64
- 1 dependencies
- normalized package name match
- Matched by: Staticcheck
MacPorts95%
staticcheck
sudo port install staticcheck- normalized package name match
- Matched by: Staticcheck
Scoop95%
main/staticcheck
scoop install main/staticcheck- normalized package name match
- Matched by: Staticcheck
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated configuration and credential file locations
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment