Hmm, thought the problem with that was poor fidelity.. from the top comment: > go.sum… ends up reporting a lot of vulnerabilities that you don't actually care

Hmm, thought the problem with that was poor fidelity.. from the top comment: > go.sum… ends up reporting a lot of vulnerabilities that you don't actually care about because your code isn't actually linking to the optional transitive dependency that has the vulnerability in it. Not a Go dev myself though.