Comment by vorticalbox

8 hours ago

same things happens with npm and CVEs, most of the ones that bubble up aren't even called in my application so are no applicable.

go lang has a scanner [0] which only shows issues when the code actually calls the effected functions.