From 9c8b73da11b03154e4e8a07bcc4ee0d7fa1048e6 Mon Sep 17 00:00:00 2001
From: Ankur Shrivastava <ankur@ankurs.com>
Date: Thu, 23 Apr 2026 10:48:31 +0800
Subject: [PATCH] fix: use govulncheck -scan=module for library CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Libraries should scan dependencies, not stdlib — the stdlib version
is the consumer's choice. -scan=module checks only go.mod deps.
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 0cc0a83..f5c12dd 100644
--- a/Makefile
+++ b/Makefile
@@ -11,7 +11,7 @@ doc:
 
 lint:
 	go tool golangci-lint run
-	go tool govulncheck ./...
+	go tool govulncheck -scan=module
 
 bench:
 	go test -run=^$$ -bench=. -benchmem ./...