tree 1ee504d3b4b1d7d3eff3123effef5af2ec32bddf
parent 1dedb030b7d7506f84955b3a88debb18fbf1f8aa
author Russ Cox <rsc@golang.org> 1666903971 -0400
committer Russ Cox <rsc@golang.org> 1666977909 +0000

vgo: add spurious dependency on github.com/miekg/dns v1.0.0

This dependency is vulnerable to GO-2020-0006.
The point of this commit is to serve as a test case for
automated vulnerability scanning of the Go repos.

Using the vgo repo because it contains nothing
important and is not imported by any of our other repos,
which means any report should be limited to x/vgo
and not affect other users.

Even if people did depend on x/vgo, govulncheck would
correctly identify that no code here calls the vulnerable
symbols in github.com/miekg/dns. Only less precise
scanners would suggest that there is a problem.

Change-Id: I97dca1c146b84764e867128710cf262ea6b68276
Reviewed-on: https://go-review.googlesource.com/c/vgo/+/446055
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Russ Cox <rsc@golang.org>