diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f9ce6410..84884e5a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -159,7 +159,9 @@ jobs:
 
       - name: Run Makefile gate self-tests
         # The local lint, scanner and terraform-validate targets must fail
-        # when their tool is missing or fails (#349). Stub tools only.
+        # when their tool is missing or fails (#349); stub tools only. Also
+        # checks with the real go command that the Go targets' ./... skips
+        # frontend/node_modules (#177).
         run: bash scripts/test-make-gates.sh
 
   # GitHub Actions workflow linting
diff --git a/go.mod b/go.mod
index 5fb3a2f6..fc0f02fa 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,13 @@ module github.com/LeanerCloud/cloud-commitments-platform
 
 go 1.26.10
 
+// Keep ./... out of frontend/node_modules (issue #177). Go's ./... skips only
+// testdata and paths starting with . or _, so after `npm ci` it picked up the
+// Go source some npm packages ship (frontend/node_modules/flatted/golang) as a
+// package of this module, and every `go vet/test/build ./...`, golangci-lint
+// and govulncheck run in that checkout checked code this repo doesn't own.
+ignore ./frontend/node_modules
+
 require (
 	github.com/aws/aws-sdk-go-v2 v1.47.3
 	github.com/aws/aws-sdk-go-v2/config v1.33.9
@@ -59,7 +66,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.45.0 // indirect
 	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	golang.org/x/crypto v0.58.0
-	golang.org/x/net v0.61.0 // indirect
+	golang.org/x/net v0.62.0 // indirect
 	golang.org/x/oauth2 v0.37.0
 	golang.org/x/sync v0.24.0
 	golang.org/x/sys v0.49.0 // indirect
diff --git a/go.sum b/go.sum
index 06deac0b..83df52e6 100644
--- a/go.sum
+++ b/go.sum
@@ -367,8 +367,8 @@ golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
 golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
 golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
-golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
-golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
 golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
diff --git a/scripts/test-make-gates.sh b/scripts/test-make-gates.sh
index 24b46648..90fbfa3f 100755
--- a/scripts/test-make-gates.sh
+++ b/scripts/test-make-gates.sh
@@ -13,6 +13,12 @@
 #      loop over terraform/environments/*/dev, which does not exist.
 #   4. Makefile.terraform's clean-locks refuses to delete the provider lock
 #      files without CONFIRM_CLEAN_LOCKS=yes.
+#   5. The Go targets' ./... (vet, test-unit, test-compile-integration,
+#      test-integration, test-coverage, fmt) skips frontend/node_modules
+#      (issue #177). Go's ./... used to pick up the Go source npm packages
+#      ship there (frontend/node_modules/flatted/golang) once deps were
+#      installed. Checked with the real go command and an -overlay probe, so
+#      no npm install is needed and nothing is written into the repo.
 #
 # Tools are stubs on a PATH that holds nothing else, so the real tools are
 # never run and nothing leaves the machine. Exits 0 when all cases pass;
@@ -150,6 +156,43 @@ else
   note_fail "clean-locks kept the lock file despite confirmation"
 fi
 
+# 5. ./... skips frontend/node_modules (go.mod's ignore directive). A probe
+# package overlaid under frontend/node_modules must not be listed; a control
+# probe overlaid elsewhere under frontend/ must be, which proves the overlay
+# took effect and that the ignore covers node_modules only.
+probe_src="$WORK/probe.go"
+printf 'package probe\n\nfunc Probe() {}\n' > "$probe_src"
+ignored_dir="frontend/node_modules/zz-make-gates-probe"
+control_dir="frontend/zz-make-gates-control"
+printf '{"Replace":{"%s":"%s","%s":"%s"}}\n' \
+  "$REPO_ROOT/$ignored_dir/probe.go" "$probe_src" \
+  "$REPO_ROOT/$control_dir/probe.go" "$probe_src" > "$WORK/overlay.json"
+GO_BIN="$(command -v go || true)"
+if [ -z "$GO_BIN" ]; then
+  note_fail "go not found on PATH; cannot check that ./... skips node_modules"
+else
+  for tags in "" "integration"; do
+    label="go list ./...${tags:+ -tags=$tags}"
+    if ! (cd "$REPO_ROOT" && "$GO_BIN" list -e -tags="$tags" -overlay "$WORK/overlay.json" \
+          -f '{{.Dir}}' ./...) > "$WORK/pkgs.log" 2> "$WORK/out.log"; then
+      note_fail "$label failed"
+      sed 's/^/    /' "$WORK/out.log"
+      continue
+    fi
+    if grep -qxF "$REPO_ROOT/$control_dir" "$WORK/pkgs.log"; then
+      note_pass "$label lists the control probe under frontend/"
+    else
+      note_fail "$label did not list the control probe (overlay not applied?)"
+    fi
+    if grep -qF "$REPO_ROOT/frontend/node_modules/" "$WORK/pkgs.log"; then
+      note_fail "$label walks into frontend/node_modules"
+      grep -F "$REPO_ROOT/frontend/node_modules/" "$WORK/pkgs.log" | sed 's/^/    /'
+    else
+      note_pass "$label skips frontend/node_modules"
+    fi
+  done
+fi
+
 echo ""
 echo "Results: ${pass} passed, ${fail} failed"
 [ "$fail" -eq 0 ]