search

golang / vscode-go

Go extension for Visual Studio Code
https://marketplace.visualstudio.com/items?itemName=golang.Go
Other
3.91k stars 758 forks source link

vuln: surface vulnerabilities in standard library more clearly #2551

Open hyangah opened 1 year ago

hyangah commented 1 year ago

We are not currently surfacing vulnerabilities in standard library as diagnostics.

We tried to attach the diagnostic to the module or go statement in go.mod. But without a clear path to address the issue from source level, we think this needs more investigation.

If https://go.dev/issue/57001 is accepted and implemented, we can place the diagnostics and quickfix to go.mod on the go directive and the toolchain. Otherwise, we can go with more vscode-go specific solution.

gopherbot commented 1 year ago

Change https://go.dev/cl/454436 mentions this issue: gopls/internal/lsp/mod: disable the diagnostics on stdlib vulns