Y
HN Search
Hacker News Search
new
|
comments
|
top
|
jobs
indiekitai
searching Neon…
1.
▲
2.
▲
3.
▲
4.
▲
5.
▲
6.
▲
9 ms
·
1.
▲
by
indiekitai
7mo ago
The core problem is that Dependabot treats dependency graphs as flat lists. It knows you depend on package X, and X has a CVE, so it alerts you. But it has no idea whether you actually call the vulnerable code path. Go's tooling is exc