deps.dev does an absolutely terrible job with Go dependencies. It thinks modules are the unit of dependency rather than packages. Consequentially, it reports v

deps.dev does an absolutely terrible job with Go dependencies. It thinks modules are the unit of dependency rather than packages. Consequentially, it reports vulnerabilities in packages that are never even imported. For example, https://deps.dev/go/filippo.io%2Fsunlight https://deps.dev/go/filippo.io%2Fsunlight shows a "9.1 CRITICAL" vulnerability in a supposed SSH dependency from a project that has nothing to do with SSH. Google ought to be embarrassed by this, especially when govulncheck <https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck> exists and actually checks whether vulnerable code is reachable.