feat: add v1 Golang Vulncheck Analyzer

[cvas22]

Description of Change

Adds a new v1 analyzer that runs the Go team's govulncheck against Go modules and reports the vulnerabilities it finds, sourced from the curated Go vulnerability database.

Unlike the CPE-matching Golang Mod Analyzer, govulncheck performs call-graph reachability analysis in source mode (govulncheck -json ./...), so it reports primarily the vulnerabilities actually reachable from the scanned code - substantially reducing false positives/negatives for Go.

Design:

Source mode only, keyed off go.mod (reuses existing module detection); binary mode is intentionally out of scope for v1.
Native -json (OSV) output; streaming parser joins osv advisories with finding records and selects the most precise (reachable) finding.
De-duplicates against other data sources via OSV aliases: reuses an existing NVD vulnerability when a CVE alias matches, otherwise synthesizes one under the GO-YYYY-NNNN id.
Reports against the vulnerable module as a synthetic pkg:golang dependency.
Disabled by default; requires go and govulncheck to be installed.

New:

GolangVulncheckAnalyzer, GovulncheckProcessor
GovulncheckJsonParser, GovulncheckResult
Settings keys analyzer.golang.vulncheck.{enabled,path}
Vulnerability.Source.GOVULNCHECK
Config wiring: CLI (--enableGolangVulncheck, --govulncheck), Ant (golangVulncheckEnabled, pathToGovulncheck), Maven (golangVulncheckEnabled, pathToGovulncheck).

Tests: unit tests for the parser and analyzer; an integration test that runs real govulncheck end-to-end (self-skips when the tool is absent).

Docs: analyzer page, analyzers index, CLI/Ant/Maven configuration, and bash completion updated.

Related issues

attempts to address #8470

Have test cases been added to cover the new functionality?

yes

[jeremylong]

Won't merge until CI errors are corrected:

[ERROR] Failures: 
[ERROR]   EngineIT.testEngine:122 Analysis threw exceptions that weren't expected
Expected: an empty collection
     but: <[org.owasp.dependencycheck.exception.InitializationException: Exception from govulncheck process: java.io.IOException: Cannot run program "govulncheck" (in directory "/home/runner/work/DependencyCheck/DependencyCheck/core/target/temp/dctemp60248e31-a9b8-4d66-b1ac-d9c9553ef241"): error=2, No such file or directory. Disabling Golang Vulncheck Analyzer]>

[Copilot]

Pull request overview

Adds an experimental v1 Go “vulncheck” analyzer integration that runs the Go team’s govulncheck in source mode, parses its streaming -json output, and maps findings into Dependency-Check dependencies/vulnerabilities with de-duplication via CVE aliases. This expands Dependency-Check’s Go support beyond CPE/NVD matching by using reachability-aware results from the curated Go vulnerability DB.

Changes:

• Introduces GolangVulncheckAnalyzer and supporting parsing/processing (GovulncheckJsonParser, GovulncheckProcessor, GovulncheckResult) plus a new Vulnerability.Source.GOVULNCHECK.
• Wires configuration for CLI/Ant/Maven (enable flag + govulncheck path) and defaults it to disabled.
• Adds unit tests for parsing/analyzer behavior and an integration test that self-skips if tooling is unavailable; updates docs and bash completion.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java	Adds settings keys for enabling vulncheck analyzer and configuring govulncheck path.
src/site/markdown/analyzers/index.md	Lists the new Golang Vulncheck Analyzer in the analyzer index.
src/site/markdown/analyzers/golang-vulncheck.md	Adds documentation page describing behavior, requirements, and configuration keys.
maven/src/site/markdown/configuration.md	Documents Maven plugin parameters for enabling vulncheck and setting govulncheck path.
maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java	Adds Maven plugin parameters and populates corresponding settings keys.
core/src/test/resources/golang/vulncheck/main.go	Adds Go test module source used by integration testing.
core/src/test/resources/golang/vulncheck/go.sum	Adds Go test module go.sum for integration testing.
core/src/test/resources/golang/vulncheck/go.mod	Adds Go test module go.mod for integration testing.
core/src/test/resources/golang/govulncheck.json	Adds sample govulncheck -json output for parser unit tests.
core/src/test/java/org/owasp/dependencycheck/data/golang/GovulncheckJsonParserTest.java	Unit tests for streaming JSON parser behavior and de-duplication/precision selection.
core/src/test/java/org/owasp/dependencycheck/analyzer/GolangVulncheckAnalyzerTest.java	Unit tests for analyzer name/phase and file acceptance behavior.
core/src/test/java/org/owasp/dependencycheck/analyzer/GolangVulncheckAnalyzerIT.java	End-to-end integration test running real govulncheck with self-skip when absent.
core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer	Registers the new analyzer via SPI.
core/src/main/resources/dependencycheck.properties	Adds default config entry setting vulncheck analyzer disabled by default.
core/src/main/java/org/owasp/dependencycheck/processing/GovulncheckProcessor.java	Converts parsed govulncheck results into synthetic Go module dependencies and vulnerabilities.
core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java	Adds GOVULNCHECK as a vulnerability source.
core/src/main/java/org/owasp/dependencycheck/data/golang/GovulncheckResult.java	Defines result model joining OSV advisory metadata with the most precise finding.
core/src/main/java/org/owasp/dependencycheck/data/golang/GovulncheckJsonParser.java	Implements framed streaming parsing of concatenated JSON messages from govulncheck -json.
core/src/main/java/org/owasp/dependencycheck/analyzer/GolangVulncheckAnalyzer.java	Implements analyzer that runs govulncheck, validates availability, and processes output.
cli/src/site/markdown/arguments.md	Documents new CLI switches --enableGolangVulncheck and --govulncheck.
cli/src/main/resources/completion-for-dependency-check.sh	Adds bash completion entries for the new CLI flags.
cli/src/main/java/org/owasp/dependencycheck/CliParser.java	Adds new CLI argument constants and option definitions for govulncheck and enable flag.
cli/src/main/java/org/owasp/dependencycheck/App.java	Wires CLI args into settings for enabling analyzer and setting govulncheck path.
ant/src/site/markdown/configuration.md	Documents Ant task attributes for enabling vulncheck and setting govulncheck path.
ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java	Adds Ant task fields/setters and populates settings for enable flag + govulncheck path.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.