Skip to content

feat: add v1 Golang Vulncheck Analyzer #8678

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cvas22 wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat: add v1 Golang Vulncheck Analyzer #8678

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2cfa5ad
feat: add experimental Golang Vulncheck Analyzer (#8470)
cvas22 Jul 21, 2026
5500db3
Merge pull request #1 from cvas22/feat/golang-vulncheck-analyzer
cvas22 Jul 21, 2026
59988f0
Merge branch 'main' into main
cvas22 Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,15 @@ public class Check extends Update {
* installed. Default is true.
*/
private Boolean golangModEnabled;
/**
* Sets whether the Golang Vulncheck Analyzer is enabled; this requires `go`
* and `govulncheck` to be installed. Default is false.
*/
private Boolean golangVulncheckEnabled;
/**
* Sets the path to `govulncheck`.
*/
private String pathToGovulncheck;
/**
* Sets the path to `go`.
*/
Expand Down Expand Up @@ -1138,6 +1147,24 @@ public void setGolangModEnabled(Boolean golangModEnabled) {
this.golangModEnabled = golangModEnabled;
}

/**
* Set the value of golangVulncheckEnabled.
*
* @param golangVulncheckEnabled new value of golangVulncheckEnabled
*/
public void setGolangVulncheckEnabled(Boolean golangVulncheckEnabled) {
this.golangVulncheckEnabled = golangVulncheckEnabled;
}

/**
* Set the value of pathToGovulncheck.
*
* @param pathToGovulncheck new value of pathToGovulncheck
*/
public void setPathToGovulncheck(String pathToGovulncheck) {
this.pathToGovulncheck = pathToGovulncheck;
}

/**
* Set the value of dartAnalyzerEnabled.
*
Expand Down Expand Up @@ -1600,8 +1627,10 @@ protected void populateSettings() throws BuildException {
getSettings().setArrayIfNotEmpty(Settings.KEYS.ANALYZER_RETIREJS_FILTERS, retireJsFilters);
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_GOLANG_DEP_ENABLED, golangDepEnabled);
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_GOLANG_MOD_ENABLED, golangModEnabled);
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_GOLANG_VULNCHECK_ENABLED, golangVulncheckEnabled);
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_DART_ENABLED, dartAnalyzerEnabled);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_GOLANG_PATH, pathToGo);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_GOLANG_VULNCHECK_PATH, pathToGovulncheck);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_YARN_PATH, pathToYarn);
getSettings().setStringIfNotNull(Settings.KEYS.ANALYZER_PNPM_PATH, pathToPnpm);
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_MIX_AUDIT_ENABLED, mixAuditAnalyzerEnabled);
Expand Down
2 changes: 2 additions & 0 deletions ant/src/site/markdown/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,9 @@ be needed.
| pathToCore | The path to dotnet core .NET assembly analysis on non-windows systems. |   |
| golangDepEnabled | Sets whether the [experimental](../analyzers/index.html) Golang Dependency Analyzer should be used. `enableExperimental` must be set to true. | true |
| golangModEnabled | Sets whether the [experimental](../analyzers/index.html) Goland Module Analyzer should be used; requires `go` to be installed. `enableExperimental` must be set to true. | true |
| golangVulncheckEnabled | Sets whether the [experimental](../analyzers/index.html) Golang Vulncheck Analyzer should be used; requires `go` and `govulncheck` to be installed. `enableExperimental` must be set to true. | false |
| pathToGo | The path to `go`. |   |
| pathToGovulncheck | The path to `govulncheck`. |   |
| versionCheckEnabled | Whether dependency-check should check if a new version of dependency-check-maven exists. | true |

Advanced Configuration
Expand Down
4 changes: 4 additions & 0 deletions cli/src/main/java/org/owasp/dependencycheck/App.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -523,6 +523,8 @@ protected void populateSettings(CliParser cli) throws InvalidSettingException {
cli.hasOption(CliParser.ARGUMENT.RETIRED));
settings.setStringIfNotNull(Settings.KEYS.ANALYZER_GOLANG_PATH,
cli.getStringArgument(CliParser.ARGUMENT.PATH_TO_GO));
settings.setStringIfNotNull(Settings.KEYS.ANALYZER_GOLANG_VULNCHECK_PATH,
cli.getStringArgument(CliParser.ARGUMENT.PATH_TO_GOVULNCHECK));
settings.setStringIfNotNull(Settings.KEYS.ANALYZER_YARN_PATH,
cli.getStringArgument(CliParser.ARGUMENT.PATH_TO_YARN));
settings.setStringIfNotNull(Settings.KEYS.ANALYZER_PNPM_PATH,
Expand Down Expand Up @@ -617,6 +619,8 @@ protected void populateSettings(CliParser cli) throws InvalidSettingException {
!cli.isDisabled(CliParser.ARGUMENT.DISABLE_GO_DEP, Settings.KEYS.ANALYZER_GOLANG_DEP_ENABLED));
settings.setBoolean(Settings.KEYS.ANALYZER_GOLANG_MOD_ENABLED,
!cli.isDisabled(CliParser.ARGUMENT.DISABLE_GOLANG_MOD, Settings.KEYS.ANALYZER_GOLANG_MOD_ENABLED));
settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_GOLANG_VULNCHECK_ENABLED,
cli.hasOption(CliParser.ARGUMENT.ENABLE_GOLANG_VULNCHECK) ? true : null);
settings.setBoolean(Settings.KEYS.ANALYZER_DART_ENABLED,
!cli.isDisabled(CliParser.ARGUMENT.DISABLE_DART, Settings.KEYS.ANALYZER_DART_ENABLED));
settings.setBoolean(Settings.KEYS.ANALYZER_NODE_PACKAGE_ENABLED,
Expand Down
12 changes: 12 additions & 0 deletions cli/src/main/java/org/owasp/dependencycheck/CliParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -472,6 +472,8 @@ private void addAdvancedOptions(final Options options) {
"The Artifactory URL."))
.addOption(newOptionWithArg(ARGUMENT.PATH_TO_GO, "path",
"The path to the `go` executable."))
.addOption(newOptionWithArg(ARGUMENT.PATH_TO_GOVULNCHECK, "path",
"The path to the `govulncheck` executable."))
.addOption(newOptionWithArg(ARGUMENT.PATH_TO_YARN, "path",
"The path to the `yarn` executable."))
.addOption(newOptionWithArg(ARGUMENT.PATH_TO_PNPM, "path",
Expand Down Expand Up @@ -551,6 +553,8 @@ private void addAdvancedOptions(final Options options) {
.addOption(newOption(ARGUMENT.DISABLE_NODE_AUDIT_SKIPDEV, "Configures the Node Audit Analyzer to skip devDependencies"))
.addOption(newOption(ARGUMENT.DISABLE_RETIRE_JS, "Disable the RetireJS Analyzer."))
.addOption(newOption(ARGUMENT.ENABLE_NEXUS, "Enable the Nexus Analyzer."))
.addOption(newOption(ARGUMENT.ENABLE_GOLANG_VULNCHECK,
"Enable the Golang Vulncheck Analyzer; requires `go` and `govulncheck` to be installed."))
.addOption(newOption(ARGUMENT.ARTIFACTORY_ENABLED, "Whether the Artifactory Analyzer should be enabled."))
.addOption(newOption(ARGUMENT.PURGE_NVD, "Purges the local NVD data cache"))
.addOption(newOption(ARGUMENT.DISABLE_HOSTED_SUPPRESSIONS, "Disable retrieval of the hosted suppressions from the configured URL."))
Expand Down Expand Up @@ -1349,6 +1353,10 @@ public static class ARGUMENT {
* The CLI argument name for setting the path to `go`.
*/
public static final String PATH_TO_GO = "go";
/**
* The CLI argument name for setting the path to `govulncheck`.
*/
public static final String PATH_TO_GOVULNCHECK = "govulncheck";
/**
* The CLI argument name for setting the path to `yarn`.
*/
Expand Down Expand Up @@ -1453,6 +1461,10 @@ public static class ARGUMENT {
* Disables the Nexus Analyzer.
*/
public static final String ENABLE_NEXUS = "enableNexus";
/**
* Enables the Golang Vulncheck Analyzer.
*/
public static final String ENABLE_GOLANG_VULNCHECK = "enableGolangVulncheck";
/**
* Disables the Sonatype OSS Index Analyzer.
*/
Expand Down
4 changes: 3 additions & 1 deletion cli/src/main/resources/completion-for-dependency-check.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,12 +72,14 @@ _odc_completions()
--dotnet
--enableArtifactory
--enableExperimental
--enableGolangVulncheck
--enableNexus
--enableRetired
--exclude <pattern>
-f --format <format>
--failOnCVSS <score>
--go
--govulncheck <path>
-h --help
--hints
--hostedSuppressionsForceUpdate
Expand Down Expand Up @@ -130,7 +132,7 @@ _odc_completions()


case "${prev}" in
-s|--scan|-o|--out|-d|--data|--bundleAudit|--bundleAuditWorkingDirectory|--dbDriverPath|--dotnet|--go|-P|--propertyfile|--suppression|--hint|-l|--log|--yarn)
-s|--scan|-o|--out|-d|--data|--bundleAudit|--bundleAuditWorkingDirectory|--dbDriverPath|--dotnet|--go|--govulncheck|-P|--propertyfile|--suppression|--hint|-l|--log|--yarn)
COMPREPLY=( $(compgen -f -o default -- ${cur}) )
return 0
;;
Expand Down
2 changes: 2 additions & 0 deletions cli/src/site/markdown/arguments.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,11 +113,13 @@ Advanced Options
| | \-\-dotnet | \<path\> | The path to dotnet core for .NET Assembly analysis on non-windows systems. | &nbsp; |
| | \-\-disableGolangDep | | Sets whether the [experimental](../analyzers/index.html) Go Dependency Analyzer should be used. | &nbsp; |
| | \-\-disableGolangMod | | Sets whether the [experimental](../analyzers/index.html) Go Mod Analyzer should be used. | &nbsp; |
| | \-\-enableGolangVulncheck | | Sets whether the [experimental](../analyzers/index.html) Golang Vulncheck Analyzer should be used; requires `go` and `govulncheck` to be installed. `enableExperimental` must also be set. | &nbsp; |
| | \-\-disableMixAudit | | Sets whether the [experimental](../analyzers/index.html) Elixir mix audit Analyze should be used. | &nbsp; |
| | \-\-disablePE | | Sets whether the [experimental](../analyzers/index.html) PE Analyzer should be used. | &nbsp; |
| | \-\-disablePoetry | | Sets whether the [experimental](../analyzers/index.html) Poetry Analyzer should be used. | &nbsp; |
| | \-\-disableVersionCheck | | Sets whether dependency-check should check if a new version is available. | &nbsp; |
| | \-\-go | \<path\> | The path to `go` executable for the Go Mode Analyzer; only necessary if `go` is not on the path. | &nbsp; |
| | \-\-govulncheck | \<path\> | The path to the `govulncheck` executable for the Golang Vulncheck Analyzer; only necessary if `govulncheck` is not on the path. | &nbsp; |
| | \-\-bundleAudit | | The path to the bundle-audit executable. | &nbsp; |
| | \-\-bundleAuditWorkingDirectory | \<path\> | The path to working directory that the bundle-audit command should be executed from when doing Gem bundle analysis. | &nbsp; |
| | \-\-proxyserver | \<server\> | The proxy server to use when downloading resources; see the [proxy configuration](../data/proxy.html) page for more information. | &nbsp; |
Expand Down
Loading