logoalt Hacker News

vorticalboxtoday at 2:54 PM0 repliesview on HN

same things happens with npm and CVEs, most of the ones that bubble up aren't even called in my application so are no applicable.

go lang has a scanner [0] which only shows issues when the code actually calls the effected functions.

[0] https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck