Pre processing for golang packages

post by srishti.suman on Aug 20, 2020

Srishti Suman

Could you please help us with below query.

Package golang.org/x/text : MinIO already uses the version v0.3.3, but is being reported as vulnerability in IQ scan.

Can Sonatype provide some pre-processing for Go components as is done for NPM components by asking the dependency management system which libraries it would pick and grab them for checking as it were.

post by bjohnson on Sep 9, 2020

Ben Johnson

I’ve got this same issue. I’m thinking this is a false positive because we vendor our deps and it’s scanning the go.sum files in our vendor directory.