tree c8aa1417ab58297f5358afe7090816c33b994590
parent d6511e5e9f58a975b5568d11282c30bc70bdc2e5
author Hana (Hyang-Ah) Kim <hyangah@gmail.com> 1666387795 -0400
committer Hyang-Ah Hana Kim <hyangah@gmail.com> 1666718830 +0000

gopls/internal/lsp/mod: merge vuln diagnostics to one, and add a hover

When a module contains multiple vulnerabilities, previously gopls published
one diagnostic message for each vulnerability. This change modifies this
behavior to publish only one vuln diagnostic for each module. This will
make the PROBLEMS panel more concise and readable. However, the information
about each vulnerability finding is useful, so we supplement this diagnostics
by sending a hover message in the module require line. An added benefit
of this approach is that, unlike the Diagnostics, VS Code supports rich
text rendering for Hover messages. So we can use markdown to add links and
necessary highlighting.

Before this change, go.mod require hover messages (e.g. go mod why result)
were associated only with the module path part, excluding the version string
part. But for vulnerability information hover message, I think it is better
to be applied to the entire module require line (both module path & version)
because they are information about the specific module/version. Currently
LSP hover returns only one hover, so we cannot use this different range only
to the vulnerability information hover. Thus, one side effect of this change
is that the module info hover message will be also shown to the version
part of each require statement.

Change-Id: Iccacd19fdebadc4768abcad8a218bbae14f9d7e2
Reviewed-on: https://go-review.googlesource.com/c/tools/+/444798
Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
gopls-CI: kokoro <noreply+kokoro@google.com>
Reviewed-by: Suzy Mueller <suzmue@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>