Strong disagree. Every "generic" vulnerability scanner still needs some language specific knowledge for how to determine what is an included dependency. The be

Strong disagree. Every "generic" vulnerability scanner still needs some language specific knowledge for how to determine what is an included dependency. The better you want to suppress false positives, the more in-depth knowledge the tool will need about each language/runtime. The end result of this is that all the existing generic scanners just use least common denominator heuristics for determining vulnerable dependencies (i.e. just look at the lock file). For large teams, this can be a huge waste of time patching vulnerabilities that don't actually apply to your code just because the scanning tool is too stupid to know better. I'll take Govulncheck (and similar tools for other languages) any day over the mediocre generic tools.