govulncheck

• Category: sca (Go-specific, reachability-aware)
• Fingerprint: cve-package-version-v1
• License: BSD-3-Clause

govulncheck analyses the Go call graph — a CVE in an imported package that no executed code path reaches is surfaced with kind=pass, not kind=fail. This reduces noise significantly on Go projects compared to pure version-match scanners.

sca:
  govulncheck: { enabled: true }

When to enable

Always on Go projects. Typically a supplement to Trivy/OSV rather than a replacement — those catch version-level issues govulncheck suppresses as unreachable.