consider running govulncheck in CI

Author: marco-mCreated Aug 7, 2026Updated Aug 10, 2026

Labelsenhancement

Hello @tristanmorgan,

this is a follow-up of https://github.com/fabiolb/fabio/pull/1065.

I suggest to consider running govulncheck in CI. I run it at work and is impressive.

Sample Action taken from https://words.filippo.io/dependabot/ (worthwhile to read all that blog post):

name: govulncheck
on:
  push:
  pull_request:
  schedule: # daily at 10:22 UTC
    - cron: '22 10 * * *'
  workflow_dispatch:
permissions:
  contents: read
jobs:
  govulncheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          persist-credentials: false
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - run: |
          go run golang.org/x/vuln/cmd/govulncheck@latest ./...

Note that currently it will trigger

Vulnerability #2: GO-2026-4736
    GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute in
    github.com/osrg/gobgp
  More info: https://pkg.go.dev/vuln/GO-2026-4736
  Module: github.com/osrg/gobgp/v3
    Found in: github.com/osrg/gobgp/[email protected]
    Fixed in: N/A
    Example traces found:
      #1: bgp/bgp_nonwindows.go:333:21: bgp.BGPHandler.DeleteRoutes calls anypb.New, which eventually calls api.Actions.ProtoReflect

I left a comment on your PR https://github.com/fabiolb/fabio/pull/1042 about this.

More about govulncheck:

Source: fabiolb/fabio

View original on GitHub View discussion on GitHub