govulncheck version
Go: go1.23.0 Scanner: govulncheck@v1.1.3
Does this issue reproduce at the latest version of golang.org/x/vuln?
yes
Output of go env in your module/workspace:
Does not matter.
What did you do?
Run govulncheck -show trace on any module that has some symbol-level vulnerabilities.
What did you see happen?
Paths in traces do not contain any module info, which can be confusing.
src/sync/once.go:67:11: ...
pkg/store/cache/caching_bucket_test.go:442:12: ...
What did you expect to see?
Show the last segment of the module name, for example:
go@v1.23.1/src/sync/once.go:67:11: ...
thanos@v0.32.5/pkg/store/cache/caching_bucket_test.go:442:12: ...
Comment From: gopherbot
Change https://go.dev/cl/614135 mentions this issue: internal/scan: add module info to symbol paths in traces mode