govulncheck warning can't be configured

[andig]

What version of Go, VS Code & VS Code Go extension are you using?

Version Information

• Run go version to get version of Go from the VS Code integrated terminal.
  • go version go1.25.5 darwin/arm64
• Run gopls -v version to get version of Gopls from the VS Code integrated terminal.

Build info
----------
golang.org/x/tools/gopls v0.0.0-20251218125106-60782aaaac9c
    golang.org/x/tools/gopls@v0.0.0-20251218125106-60782aaaac9c
    github.com/BurntSushi/toml@v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
    github.com/fatih/camelcase@v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
    github.com/fatih/gomodifytags@v1.17.1-0.20250423142747-f3939df9aa3c h1:dDSgAjoOMp8da3egfz0t2S+t8RGOpEmEXZubcGuc0Bg=
    github.com/fatih/structtag@v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
    github.com/fsnotify/fsnotify@v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
    github.com/google/go-cmp@v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
    github.com/google/jsonschema-go@v0.3.0 h1:6AH2TxVNtk3IlvkkhjrtbUc4S8AvO0Xii0DxIygDg+Q=
    github.com/modelcontextprotocol/go-sdk@v1.1.0 h1:Qjayg53dnKC4UZ+792W21e4BpwEZBzwgRW6LrjLWSwA=
    github.com/yosida95/uritemplate/v3@v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
    golang.org/x/exp/typeparams@v0.0.0-20251209150349-8475f28825e9 h1:DXiKAjbw2KpfWz1Bq2YqF/dBDPEZGJsl3IA2JuVzy8U=
    golang.org/x/mod@v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
    golang.org/x/sync@v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
    golang.org/x/sys@v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
    golang.org/x/telemetry@v0.0.0-20251208220230-2638a1023523 h1:H52Mhyrc44wBgLTGzq6+0cmuVuF3LURCSXsLMOqfFos=
    golang.org/x/text@v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
    golang.org/x/tools@v0.40.0 => ../
    golang.org/x/vuln@v1.1.4 h1:Ju8QsuyhX3Hk8ma3CesTbO8vfJD9EvUBgHvkxHBzj0I=
    honnef.co/go/tools@v0.7.0-0.dev.0.20251022135355-8273271481d0 h1:5SXjd4ET5dYijLaf0O3aOenC0Z4ZafIWSpjUzsQaNho=
    mvdan.cc/gofumpt@v0.9.2 h1:zsEMWL8SVKGHNztrx6uZrXdp7AX8r421Vvp23sz7ik4=
    mvdan.cc/xurls/v2@v2.6.0 h1:3NTZpeTxYVWNSokW3MKeyVkz/j7uYXYiMtXRUfmjbgI=
go: go1.25.5

• Run code -v or code-insiders -v to get version of VS Code or VS Code Insiders.
  • 1.107.1 (Universal)
• Check your installed extensions to get the version of the VS Code Go extension
• Run Ctrl+Shift+P (Cmd+Shift+P on Mac OS) > Go: Locate Configured Go Tools command.

Share the Go related settings you have added/edited

    "gopls": {
        "formatting.gofumpt": false,
        "zeroConfig": false,
        "analyses": {
            "loopclosure": false
        }
    },
    "go.languageServerFlags": [
        "serve",
        "-rpc.trace",
        "--debug=localhost:6060"
    ],

Describe the bug

I receive a lot of

Dependencies have changed in /Users/a25058/htdocs/evcc/go.mod, would you like to run govulncheck to check for vulnerabilities?

messages when switching branches. Even if selecting "never" or "always" I keep getting more popups on the next switch.

Steps to reproduce the behavior:

1. switch branch with different go.mod
2. popup keeps reappearing

[h9jiang]

Hi andig

Thank you so much for reporting this.

I'm a little bit surprise to see you are using the gopls v0.0.0-20251218125106-60782aaaac9c.

Hi Ethan, @ethanalee-work could you provide some instructions on how to disable this?

[mrjrieke]

I'm experiencing the same issue. For large multi module workspaces, it's very distracting on startup of vscode.

[ethanalee-work]

Hi, apologies for the late reply. 

We need to fix this so that switching branches does not induce this behavior. In the meantime, you can turn swap modes to the following:

In your settings.json please modify the following settings for gopls:

    "gopls": {
        // other settings
        "vulncheck": "Imports", // To turn on automatic govulncheck scanning please use "Prompt"
    },

And then restart the gopls server using Cmd+Shift+P and selecting Go: Restart Language Server.

[joel-rieke]

This might be bigger than when just switching branches. This seems to happen to me every time I start vscode on a multi repository workspace. I tried even turning vulncheck off altogether. I get spammed by pretty much every repository with this error now. Something recently in the last few months started triggering this. Though honestly it might be because I switched to using mulitple repositories in the same workspace and I'm triggering something new?

[ethanalee-work]

Hi @joel-rieke, sorry to hear that you are experiencing this and we will try to get this resolved soon.

Just to clarify, have you tried what I suggested in #3959 (comment)?

The gopls language server should be picking up the setting you set in settings.json if you are using the same workspace. This feature should be turned off if you either (1) Do not use "Prompt" in settings.json or (2) Select "Never" via the prompt.

If you could walk me through exactly your set up and how to reproduce your issue, we can better assist you and others. Thanks!

[joel-rieke]

I can give it a shot now I guess.

[ethanalee-work]

Hi @andig,

I have tried to reproduce your issue locally and it looks like even switching git branches with a different go.mod should preserve your prior vulncheck selection.

The selection should be stored in ~/.config/gopls/vulncheck/settings.json:

$ cat ~/.config/gopls/vulncheck/settings.json
{"vulncheck":"Never"}

Could you inspect that file and see if the preference has been saved correctly?

Furthermore, if that doesn't work, could try again with the latest tip of tree build: go install golang.org/x/tools/gopls@master

[joel-rieke]

Hi @andig,

I have tried to reproduce your issue locally and it looks like even switching git branches with a different go.mod should preserve your prior vulncheck selection.

The selection should be stored in ~/.config/gopls/vulncheck/settings.json:

$ cat ~/.config/gopls/vulncheck/settings.json
{"vulncheck":"Never"}

Could you inspect that file and see if the preference has been saved correctly?

Furthermore, if that doesn't work, could try again with the latest tip of tree build: go install golang.org/x/tools/gopls@master

Interesting. I don't even have that file. I've been messing with the configs for awhile now though trying to get the errors to stop. They have stopped, but maybe I accidentally deleted the file entirely. I'll try what you've suggested. And thanks!

[andig]

The selection should be stored in ~/.config/gopls/vulncheck/settings.json:

No such thing:

cat ~/.config/gopls/vulncheck/settings.json
cat: /Users/a25058/.config/gopls/vulncheck/settings.json: No such file or directory

Interesting. I don't even have that file.

Neither do I (MacOS).

[andig]

Furthermore, if that doesn't work, could try again with the latest tip of tree build: go install golang.org/x/tools/gopls@master

Maybe I have my blonde day, but no:

go install golang.org/x/tools/gopls@master
go: golang.org/x/tools/gopls@master (in golang.org/x/tools/gopls@v0.0.0-20260108161641-ca281cf95054):
	The go.mod file for the module providing named packages contains one or
	more replace directives. It must not contain directives that would cause
	it to be interpreted differently than if it were the main module.