Because all of containernetworking/cni is currently a single go module, a CVE in any dependency (or any part of cni itself) causes fire drills in all packages that use any part of containernetworking/cni. In particular, packages that only import pkg/types (pkg/utils, pkg/ns, etc) get tagged for CVEs that only affect pkg/invoke.
Reorganizing the code and splitting into multiple golang modules will help security scanners avoid these false positives.
Because all of
containernetworking/cniis currently a single go module, a CVE in any dependency (or any part ofcniitself) causes fire drills in all packages that use any part ofcontainernetworking/cni. In particular, packages that only importpkg/types(pkg/utils,pkg/ns, etc) get tagged for CVEs that only affectpkg/invoke.Reorganizing the code and splitting into multiple golang modules will help security scanners avoid these false positives.