Upgrade go.

[Tang8330]

Upgrading Go to address CVEs stemming from stdlib

[alerque]

Do the CVEs really affect this app or do they just happen to exist in an unrelated/unused API surface in Go?

[Tang8330]

Not sure, but given it's just a Go upgrade, I don't see why we wouldn't just address them.

[alerque]

At least one of those has already been brought up here: #409 (comment).

The more general point of "why not just bump" is also addressed in places like here: #458 (comment).

[Tang8330]

I understand the position of not wanting to bump for the sake of bumping a CVE that may not actually impact age, thus generating busywork.

However, how do you plan to actually tackle triaging to ensure that appropriate CVEs are being addressed and providing a rationale for why particular CVEs that have been flagged are being purposefully ignored?

[FiloSottile]

None of those affect packages that are reachable from this project, so there is nothing to triage.

$ govulncheck ./...
=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.

See https://filippo.io/maintenance#on-security-scanners. Please use a better scanner.