The toolkit for the Go programming language now includes the capability to monitor vulnerabilities in libraries. To check your projects for dependencies with unresolved vulnerabilities, a utility called 'govulncheck' is available, which analyzes the codebase of the project and provides a report on the use of vulnerable functions. Additionally, a package named vulncheck has been prepared, offering an API to integrate checks into various projects and utilities.
Checks are performed against a specially created vulnerability database managed by the Go Security Team. This database contains information on known vulnerabilities in publicly distributed modules written in Go. Data is collected from various sources, including CVE and GHSA (GitHub Advisory Database) reports, as well as information provided by package maintainers. A library, Web API, and web interface are available for querying data from the database.
Source: opennet.ru
