# Govulncheck

JSON vulnerability report generated by govulncheck tool, using a command like `govulncheck -json . >> report.json`

### Govulncheck Scanner V2

A second scan type, **Govulncheck Scanner V2**, is available for the streaming JSON format (`govulncheck -format json ./...`). It addresses several limitations of the original parser:

- It iterates the `finding` records instead of the `osv` advisory definitions, so advisories that are present in the vulnerability database stream but do not apply to the scanned code are no longer imported (this previously inflated the finding count).

- The Go vulnerability database does not publish CVSS scores, so severity is derived from govulncheck’s reachability level, kept separate per tier:

- `symbol` (the vulnerable symbol is called) → **High**  
  - `package` (the vulnerable package is imported) → **Low**  
  - `module` (the vulnerable module is required) → **Info**

Use the _Minimum Severity_ import option (e.g. `High`) to keep only the reachable findings, matching the default `govulncheck ./...` output.

- One finding is produced per (advisory, module) pair so multi-module advisories map to the correct vulnerable components.

The original **Govulncheck Scanner** parser is unchanged and remains available.

### SARIF format

The Govulncheck Scanner parsers only accept govulncheck’s native JSON output (`govulncheck -format json`). To import govulncheck’s SARIF output (`govulncheck -format sarif`), use the generic **SARIF** scan type instead — not the Govulncheck Scanner scan type. Uploading a SARIF report to a Govulncheck Scanner parser fails with an error pointing you to the SARIF scan type.

### Sample Scan Data

Sample Govulncheck scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/govulncheck).

### Default Deduplication Hashcode Fields

By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/):

- title  
- cwe  
- line  
- file path  
- description