Vulnerability Management for Go

Re:Vulnerability Management for Go by salmo on Tuesday September 06, 2022 @06:29PM (#32744042)

Well, I do understand that the actual version used there is ambiguous.

Probably the best would be to take the newest from go.sum. That’s what some scanners are doing now.

Filed bugs with 2 vendors over this though.

[ Parent | on HN ]

Re:Vulnerability Management for Go by preseinger on Tuesday September 06, 2022 @07:17PM (#32744398)

The newest from go.sum isn't reliably the version used in the dep graph. The only way to get that information reliably is via go list. Unfortunately.

[ Parent | on HN ]

Re:Vulnerability Management for Go by salmo on Tuesday September 06, 2022 @07:31PM (#32744520)

Oh, you are totally right. I read that in the GitLab issue tracking their version of the problem and totally forgot that’s where they landed.

[ Parent | on HN ]

Re:Vulnerability Management for Go by smoyer on Wednesday September 07, 2022 @09:15AM (#32750130)

Also don't forget that more than one version of a dependency might be compiled into your application!

[ Parent | on HN ]

Re:Vulnerability Management for Go by preseinger on Thursday September 08, 2022 @03:42PM (#32770985)

Only one major version. And go considers different major versions to be different dependencies.

[ Parent | on HN ]

Re:Vulnerability Management for Go by arccy on Wednesday September 07, 2022 @11:02AM (#32751554)

not true for go

[ Parent | on HN ]

Re:Vulnerability Management for Go by kubanczyk on Wednesday September 07, 2022 @05:42AM (#32748517)

For the curious it's:

    go list -m all

[ Parent | on HN ]