News for hackers. Stuff that matters.

A comment on Vulnerability Management for Go. Parent comment

Re:Vulnerability Management for Go by preseinger on Tuesday September 06, 2022 @07:17PM (#32744398)
The newest from go.sum isn't reliably the version used in the dep graph. The only way to get that information reliably is via go list. Unfortunately.
[ Parent | on HN ]
Re:Vulnerability Management for Go by salmo on Tuesday September 06, 2022 @07:31PM (#32744520)
Oh, you are totally right. I read that in the GitLab issue tracking their version of the problem and totally forgot that’s where they landed.
[ Parent | on HN ]
Re:Vulnerability Management for Go by smoyer on Wednesday September 07, 2022 @09:15AM (#32750130)
Also don't forget that more than one version of a dependency might be compiled into your application!
[ Parent | on HN ]
Re:Vulnerability Management for Go by preseinger on Thursday September 08, 2022 @03:42PM (#32770985)
Only one major version. And go considers different major versions to be different dependencies.
[ Parent | on HN ]
Re:Vulnerability Management for Go by arccy on Wednesday September 07, 2022 @11:02AM (#32751554)
not true for go
[ Parent | on HN ]
Re:Vulnerability Management for Go by kubanczyk on Wednesday September 07, 2022 @05:42AM (#32748517)
For the curious it's:

    go list -m all
[ Parent | on HN ]