Vulnerability of dependency "golang.org/x/net"

[Silence-worker-02]

Hello, we are a team researching the dependency management mechanism of Golang. During our analysis, we came across your project and noticed that it contains a vulnerability (CVE-2022-41723). In your project, the golang.org/x/net package is being used at version golang.org/x/net v0.0.0-20220520000938-2e3eb7b945c2, but the patched version is v0.7.0. To fix the vulnerability, we recommend modifying the go.mod file to update the version to v0.7.0. Thank you for your attention to this matter.

[Silence-worker-02]

We also came across your project and noticed that it contains a vulnerability (CVE-2022-32149). In your project, the golang.org/x/text package is being used at version golang.org/x/text v0.3.7, but the patched version is v0.3.8. To fix the vulnerability, we recommend modifying the go.mod file to update the version to v0.3.8 or higher. Thank you for your attention to this matter.

[bucketcat]

Any reason why Dependabot (properly configured for Go) isn't picking up on this?

Edit: Because x/Net is being inherited through the x wildcard. Adding x/Net to go.mod caused it to instantly pick up on it.

This is maybe an issue with Dependabot not going through all sub packages and lazy developers importing entire packages rather than being narrow.