govulncheck

Canonical guidance

• run govulncheck regularly
• prioritize reachable vulnerabilities over raw dependency presence
• document remediation or accepted-risk decisions

Use when

• CI security checks
• dependency upgrades
• incident or audit preparation

Avoid

• treating every advisory as equally actionable
• ignoring findings because the dependency is indirect
• replacing ordinary upgrade policy with scanner output alone

Preferred pattern

govulncheck ./...

Anti-pattern

• suppressing all findings because the first report contained one unreachable advisory

Explanation: This anti-pattern is tempting because false urgency is frustrating, but reachability-aware triage is the point of the tool.

Why

• govulncheck adds security signal that is specific to Go call paths and module metadata