Govulncheck is one of the Go ecosystem's best features, and that's saying something! I made a GitHub action that alerts if a PR adds a vulnerable call, which I

Govulncheck is one of the Go ecosystem's best features, and that's saying something! I made a GitHub action that alerts if a PR adds a vulnerable call, which I think pairs nicely with the advice to only actually fix vulnerable calls. https://github.com/imjasonh/govulncheck-action https://github.com/imjasonh/govulncheck-action You can also just run the stock tool in your GHA, but I liked being able to get annotations and comments in the PR. Incidentally, the repo has dependabot enabled with auto-merge for those PRs, which is IMO the best you can do for JS codebases.