IIRC, go applications with vendored modules/go-packages, if rpm-packaged carefully, do provide go-package dependency information via the rpm-provides tag for vendored packages. I wonder about "imports" of golang's stdlib go-packages.

Usecase: go.dev releases a new golang version because an included package (e.g. net) has a critical flaw. A local app does not use that package and therefore does not need to be recompiled. How could I enumerate the rpm packages that need to be recompiled?

Would this info generally be desirable? Maybe with help of go-rpm-macros?

go list -json | jq .Imports

shows such imports, when executed in the source/building directory.

rpm-provides tag example:

stdlib: bundled(golang(net)) = go1.21.9

vs

module: bundled(golang(golang.org/x/net)) = 0.24.0