vulnscan

Overview ¶

vulnscan runs govulncheck over every repository of a list and says, for each, whether a known vulnerability is REACHABLE from its code -- and, as loudly, whether the scan could read the code at all.

Written on 2026-10-10, after thirteen standard-library advisories (fixed in go1.27.2) and five x/net HTTP/2 ones (GO-2026-6603/6610/6611/6612/6617, fixed in golang.org/x/net v0.60.0) were published together, and one organisation turned out to reach them in 23 of 31 repositories through gRPC's HTTP/2 server transport. Dependabot had raised nothing: it matches requirements, not reachability, and does not load the code.

Every repository is cloned at depth 1 into a scratch directory, scanned, and removed. Each rule below is a wrong answer some earlier sweep gave:

• ⛔ UNREAD IS NOT CLEAN. govulncheck that cannot load the packages still prints its config to stdout, with no finding, and exits 1. Read as JSON alone that is a clean repository. See judge.
• ⛔ GOOS=linux, not the host's. Linux-only files are invisible on darwin, and nineteen findings were hidden that way before. -goos adds more.
• ⛔ THE STANDARD LIBRARY IS JUDGED BY ONE VERSION, the toolchain the scan runs under -- so it is set (-go), not inherited from the host, and a scan whose config reports another version is refused.
• ⛔ A `replace => ../X` NEEDS X. A sibling repository of the same organisation is cloned next to the repository, or the load fails.
• ⛔ EVERY MODULE, not the root one: a nested go.mod is a separate build.

It makes no GitHub REST call per repository -- cloning over https costs the API budget nothing, and Renovate shares that budget.

Exit status: 0 when every repository was read and none reaches anything, 1 when something is reachable, 2 when anything could not be read -- a refusal to answer outranks an answer.