feat: add v1 Golang Vulncheck Analyzer by cvas22 · Pull Request #8678 · dependency-check/DependencyCheck

cvas22 · 2026-07-21T03:08:26Z

Description of Change

Adds a new v1 analyzer that runs the Go team's govulncheck against Go modules and reports the vulnerabilities it finds, sourced from the curated Go vulnerability database.

Unlike the CPE-matching Golang Mod Analyzer, govulncheck performs call-graph reachability analysis in source mode (govulncheck -json ./...), so it reports primarily the vulnerabilities actually reachable from the scanned code - substantially reducing false positives/negatives for Go.

Design:

Source mode only, keyed off go.mod (reuses existing module detection); binary mode is intentionally out of scope for v1.
Native -json (OSV) output; streaming parser joins osv advisories with finding records and selects the most precise (reachable) finding.
De-duplicates against other data sources via OSV aliases: reuses an existing NVD vulnerability when a CVE alias matches, otherwise synthesizes one under the GO-YYYY-NNNN id.
Reports against the vulnerable module as a synthetic pkg:golang dependency.
Disabled by default; requires go and govulncheck to be installed.

New:

GolangVulncheckAnalyzer, GovulncheckProcessor
GovulncheckJsonParser, GovulncheckResult
Settings keys analyzer.golang.vulncheck.{enabled,path}
Vulnerability.Source.GOVULNCHECK
Config wiring: CLI (--enableGolangVulncheck, --govulncheck), Ant (golangVulncheckEnabled, pathToGovulncheck), Maven (golangVulncheckEnabled, pathToGovulncheck).

Tests: unit tests for the parser and analyzer; an integration test that runs real govulncheck end-to-end (self-skips when the tool is absent).

Docs: analyzer page, analyzers index, CLI/Ant/Maven configuration, and bash completion updated.

Related issues

attempts to address #8470

Have test cases been added to cover the new functionality?

yes

Adds a new experimental analyzer that runs the Go team's `govulncheck` against Go modules and reports the vulnerabilities it finds, sourced from the curated Go vulnerability database. Unlike the CPE-matching Golang Mod Analyzer, govulncheck performs call-graph reachability analysis in source mode (`govulncheck -json ./...`), so it reports primarily the vulnerabilities actually reachable from the scanned code - substantially reducing false positives/negatives for Go. Design: - Source mode only, keyed off `go.mod` (reuses existing module detection); binary mode is intentionally out of scope for v1. - Native `-json` (OSV) output; streaming parser joins `osv` advisories with `finding` records and selects the most precise (reachable) finding. - De-duplicates against other data sources via OSV aliases: reuses an existing NVD vulnerability when a CVE alias matches, otherwise synthesizes one under the GO-YYYY-NNNN id. - Reports against the vulnerable module as a synthetic pkg:golang dependency. Disabled by default; requires `go` and `govulncheck` to be installed. New: - GolangVulncheckAnalyzer, GovulncheckProcessor - GovulncheckJsonParser, GovulncheckResult - Settings keys analyzer.golang.vulncheck.{enabled,path} - Vulnerability.Source.GOVULNCHECK Config wiring: CLI (--enableGolangVulncheck, --govulncheck), Ant (golangVulncheckEnabled, pathToGovulncheck), Maven (golangVulncheckEnabled, pathToGovulncheck). Tests: unit tests for the parser and analyzer; an integration test that runs real govulncheck end-to-end (self-skips when the tool is absent). Docs: analyzer page, analyzers index, CLI/Ant/Maven configuration, and bash completion updated.

feat: add experimental Golang Vulncheck Analyzer (dependency-check#8470)

jeremylong · 2026-07-29T12:53:16Z

Won't merge until CI errors are corrected:

[ERROR] Failures: 
[ERROR]   EngineIT.testEngine:122 Analysis threw exceptions that weren't expected
Expected: an empty collection
     but: <[org.owasp.dependencycheck.exception.InitializationException: Exception from govulncheck process: java.io.IOException: Cannot run program "govulncheck" (in directory "/home/runner/work/DependencyCheck/DependencyCheck/core/target/temp/dctemp60248e31-a9b8-4d66-b1ac-d9c9553ef241"): error=2, No such file or directory. Disabling Golang Vulncheck Analyzer]>

…flag CliParser.hasOption(String) returns a nullable Boolean (null when the option is absent). The --enableGolangVulncheck wiring passed it through a `? true : null` ternary, which unboxed the null in the condition and threw a NullPointerException in App.populateSettings (failing AppTest and the CI Build and Test job on all JDKs). Pass the nullable Boolean straight to setBooleanIfNotNull, matching the other enable-flag options (e.g. Nexus): absent -> null -> setting is left at its default; present -> true -> analyzer enabled.

fix(cli): avoid NPE from nullable hasOption() for govulncheck enable …

Copilot

Pull request overview

Adds an experimental v1 Go “vulncheck” analyzer integration that runs the Go team’s govulncheck in source mode, parses its streaming -json output, and maps findings into Dependency-Check dependencies/vulnerabilities with de-duplication via CVE aliases. This expands Dependency-Check’s Go support beyond CPE/NVD matching by using reachability-aware results from the curated Go vulnerability DB.

Changes:

Introduces GolangVulncheckAnalyzer and supporting parsing/processing (GovulncheckJsonParser, GovulncheckProcessor, GovulncheckResult) plus a new Vulnerability.Source.GOVULNCHECK.
Wires configuration for CLI/Ant/Maven (enable flag + govulncheck path) and defaults it to disabled.
Adds unit tests for parsing/analyzer behavior and an integration test that self-skips if tooling is unavailable; updates docs and bash completion.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java	Adds settings keys for enabling vulncheck analyzer and configuring `govulncheck` path.
src/site/markdown/analyzers/index.md	Lists the new Golang Vulncheck Analyzer in the analyzer index.
src/site/markdown/analyzers/golang-vulncheck.md	Adds documentation page describing behavior, requirements, and configuration keys.
maven/src/site/markdown/configuration.md	Documents Maven plugin parameters for enabling vulncheck and setting `govulncheck` path.
maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java	Adds Maven plugin parameters and populates corresponding settings keys.
core/src/test/resources/golang/vulncheck/main.go	Adds Go test module source used by integration testing.
core/src/test/resources/golang/vulncheck/go.sum	Adds Go test module `go.sum` for integration testing.
core/src/test/resources/golang/vulncheck/go.mod	Adds Go test module `go.mod` for integration testing.
core/src/test/resources/golang/govulncheck.json	Adds sample `govulncheck -json` output for parser unit tests.
core/src/test/java/org/owasp/dependencycheck/data/golang/GovulncheckJsonParserTest.java	Unit tests for streaming JSON parser behavior and de-duplication/precision selection.
core/src/test/java/org/owasp/dependencycheck/analyzer/GolangVulncheckAnalyzerTest.java	Unit tests for analyzer name/phase and file acceptance behavior.
core/src/test/java/org/owasp/dependencycheck/analyzer/GolangVulncheckAnalyzerIT.java	End-to-end integration test running real `govulncheck` with self-skip when absent.
core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer	Registers the new analyzer via SPI.
core/src/main/resources/dependencycheck.properties	Adds default config entry setting vulncheck analyzer disabled by default.
core/src/main/java/org/owasp/dependencycheck/processing/GovulncheckProcessor.java	Converts parsed govulncheck results into synthetic Go module dependencies and vulnerabilities.
core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java	Adds `GOVULNCHECK` as a vulnerability source.
core/src/main/java/org/owasp/dependencycheck/data/golang/GovulncheckResult.java	Defines result model joining OSV advisory metadata with the most precise finding.
core/src/main/java/org/owasp/dependencycheck/data/golang/GovulncheckJsonParser.java	Implements framed streaming parsing of concatenated JSON messages from `govulncheck -json`.
core/src/main/java/org/owasp/dependencycheck/analyzer/GolangVulncheckAnalyzer.java	Implements analyzer that runs `govulncheck`, validates availability, and processes output.
cli/src/site/markdown/arguments.md	Documents new CLI switches `--enableGolangVulncheck` and `--govulncheck`.
cli/src/main/resources/completion-for-dependency-check.sh	Adds bash completion entries for the new CLI flags.
cli/src/main/java/org/owasp/dependencycheck/CliParser.java	Adds new CLI argument constants and option definitions for `govulncheck` and enable flag.
cli/src/main/java/org/owasp/dependencycheck/App.java	Wires CLI args into settings for enabling analyzer and setting `govulncheck` path.
ant/src/site/markdown/configuration.md	Documents Ant task attributes for enabling vulncheck and setting `govulncheck` path.
ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java	Adds Ant task fields/setters and populates settings for enable flag + `govulncheck` path.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                    } catch (DatabaseException ex) {
+                        LOGGER.debug("Unable to look up alias {} for govulncheck advisory {}", alias, result.getId());
+                    }


+        } catch (AnalysisException ae) {
+            final String msg = String.format("Exception from govulncheck process: %s. Disabling %s", ae.getCause(), ANALYZER_NAME);
+            throw new InitializationException(msg, ae);


Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

jeremylong

In addition, the configuration needs to be added to the ant task and maven plugin.

…lncheckAnalyzer.java Co-authored-by: Jeremy Long <jeremy.long@gmail.com>

Copilot

🟡 Changes recommended

Current result grouping and virtual-dependency merging can silently omit vulnerabilities, and one unit test is guaranteed to fail.

Get a fresh assessment by requesting another Copilot review.

Review details

Files reviewed: 24/25 changed files
Comments generated: 5
Review effort level: Balanced

+            if (exitValue != 0) {
+                LOGGER.warn("govulncheck returned exit code {} while analyzing '{}'. Results may be incomplete. {}",
+                        exitValue, dependency.getFilePath(), StringUtils.trimToEmpty(error));
+            }


+                final String id = finding.getString("osv", null);
+                if (id != null && isMorePrecise(finding, bestFinding.get(id))) {
+                    bestFinding.put(id, finding);


+        final Dependency dependency = createDependency(result);
+        final Vulnerability vulnerability = resolveVulnerability(result);
+        dependency.addVulnerability(vulnerability);
+        engine.addDependency(dependency);


+
+    @Test
+    void testGetAnalysisPhase() {
+        assertThat(analyzer.getAnalysisPhase(), is(AnalysisPhase.PRE_INFORMATION_COLLECTION));


+        } catch (InitializationException e) {
+            assertNotNull(e);
+        } finally {
+            assertFalse(analyzer.isEnabled());


cvas22 added 2 commits July 20, 2026 20:00

Merge pull request #1 from cvas22/feat/golang-vulncheck-analyzer

5500db3

feat: add experimental Golang Vulncheck Analyzer (dependency-check#8470)

boring-cyborg Bot added ant changes to ant cli changes to the cli core changes to core documentation site documentation maven changes to the maven plugin tests test cases utils changes to utils labels Jul 21, 2026

cvas22 and others added 2 commits July 23, 2026 00:23

Merge branch 'main' into main

59988f0

Merge branch 'main' into main

74069f4

cvas22 added 3 commits July 29, 2026 05:55

Merge branch 'main' into main

5636a1a

Merge pull request #2 from cvas22/fix/golang-vulncheck-cli-npe

eec4eaa

fix(cli): avoid NPE from nullable hasOption() for govulncheck enable …

jeremylong requested a review from Copilot July 31, 2026 10:48

Copilot started reviewing on behalf of jeremylong July 31, 2026 10:48 View session

Copilot AI reviewed Jul 31, 2026

View reviewed changes

cvas22 added 3 commits July 31, 2026 10:33

Merge branch 'main' into main

cb36fbd

Merge branch 'main' into main

36b297e

Merge branch 'main' into main

683cae2

chadlwilson requested a balanced review from Copilot August 20, 2026 09:13

Copilot AI reviewed Aug 20, 2026

jeremylong reviewed Sep 12, 2026

View reviewed changes

Comment thread core/src/main/java/org/owasp/dependencycheck/analyzer/GolangVulncheckAnalyzer.java Outdated

cvas22 and others added 2 commits September 12, 2026 08:46

Merge branch 'main' into main

e2612fe

Update core/src/main/java/org/owasp/dependencycheck/analyzer/GolangVu…

de57e95

…lncheckAnalyzer.java Co-authored-by: Jeremy Long <jeremy.long@gmail.com>

jeremylong requested a balanced review from Copilot September 13, 2026 11:26

Copilot started reviewing on behalf of jeremylong September 13, 2026 11:27 View session

Copilot AI reviewed Sep 13, 2026

View reviewed changes

Navigation Menu

feat: add v1 Golang Vulncheck Analyzer - #8678

feat: add v1 Golang Vulncheck Analyzer#8678
cvas22 wants to merge 12 commits into
dependency-check:mainfrom
cvas22:main

cvas22 commented Jul 21, 2026

Uh oh!

jeremylong commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

jeremylong left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

cvas22 commented Jul 21, 2026

Description of Change

Related issues

Have test cases been added to cover the new functionality?

Uh oh!

jeremylong commented Jul 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

jeremylong left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants