Awesome Reviewers

Verification · Supply chain · Dependency audit

Reachability-aware audit

Report a vulnerable dependency only when the vulnerable function is called.

How to build it

  1. Run govulncheck on the module so it reports only vulnerabilities in functions the code calls.
  2. Read the call path in each report before upgrading the dependency.
  3. Run it in CI on pull requests and on a daily schedule.

Signals in a repository

  • A govulncheck step in CI or a script target that runs govulncheck on the module.
  • go.mod and go.sum files with the vulnerability check wired into the pipeline.

In practice

4 repositories run a tool for this check in the scanned set.

  • govulncheck · 4 repos

Examples