From f10857bec1ffd678bc8d5fc30479d90f25f3c0a2 Mon Sep 17 00:00:00 2001
From: Ankur Shrivastava <ankur@ankurs.com>
Date: Thu, 23 Apr 2026 10:48:46 +0800
Subject: [PATCH] fix: use govulncheck -scan=module for library CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Libraries should scan dependencies, not stdlib — the stdlib version
is the consumer's choice. -scan=module checks only go.mod deps.
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e666208..999f2a8 100644
--- a/Makefile
+++ b/Makefile
@@ -10,7 +10,7 @@ test-v:
 
 lint:
 	go tool golangci-lint run
-	go tool govulncheck ./...
+	go tool govulncheck -scan=module
 
 bench:
 	go test -run=^$$ -bench=. -benchmem ./...