govulncheck
Known vulnerabilities in a Go module’s dependencies, with the call path that reaches them.
Why install it
Section titled “Why install it”govulncheck checks a Go module against the Go vulnerability database and then follows the code’s call graph, so it can tell a vulnerable dependency the code actually calls from one that only sits in go.mod, and it shows the call path from your function down to the vulnerable one. It overlaps with osv-scanner: when go is installed, osv-scanner runs the same call analysis (it is built on govulncheck’s library) to tell reachable Go vulnerabilities from unreachable ones, in reviews you ask for. What govulncheck adds is the call trace, which explains why a vulnerability is reachable and is what a reviewer needs to judge it. Install it if you write Go and want that explanation; osv-scanner’s verdict alone may be enough otherwise.
At a glance
Section titled “At a glance”| Finds | Dependencies |
| Reads | Go |
| Trust level | Drives a toolchain |
| Official image | Not included |
| Licence | BSD-3-Clause |
| Argus tool | run_govulncheck |
Install
Section titled “Install”The official Argus container image does not ship govulncheck: add it by building your own image on top of the official one, or install every one of these binaries on the daemon host:
go:brew install go (or see https://go.dev/doc/install)govulncheck:go install golang.org/x/vuln/cmd/govulncheck@latest
For other platforms, follow the official install guide. Argus looks for scanners once, when the daemon starts: restart it after installing, and argus doctor shows govulncheck as installed.