fix(osvscanner): filter Grafana Go SDK dependencies

[alectimison-maker]

Summary

• filter OSV findings inherited from the selected grafana-plugin-sdk-go version
• preserve findings for direct plugin dependencies, unrelated indirect modules,
  and version mismatches
• fail open when the SDK module file cannot be fetched or parsed

Motivation

The JavaScript lockfile path already removes vulnerabilities inherited from
Grafana packages, but the Go path returned every OSV result unchanged. This can
block a plugin submission for a vulnerability in a module managed by the
Grafana Go SDK rather than by the plugin.

Closes #453.

Design

The filter parses the plugin's go.mod, resolves its selected
grafana-plugin-sdk-go version, and downloads only that version's bounded
go.mod from the Go module proxy. A finding is excluded only when:

• the plugin declares the vulnerable module as indirect;
• the SDK module file declares the same module; and
• the plugin, SDK, and OSV result versions match.

This is intentionally stricter than name-only filtering so a plugin's direct
dependency or independently upgraded version remains visible. Fetch, status,
size, version, and parse failures retain the original findings.

Testing

• go test ./pkg/analysis/passes/osvscanner/... — passed
• go vet ./pkg/analysis/passes/osvscanner/... — passed
• go build -o bin/darwin_arm64/plugincheck2 ./pkg/cmd/plugincheck2 — passed
• go test ./pkg/cmd/plugincheck2 -count=1 — passed
• go test ./pkg/... — passed

Compatibility and risks

JavaScript lockfile behavior and public APIs are unchanged. Go modules that do
not explicitly list transitive requirements keep their existing findings. The
new module-proxy request has a 10-second timeout and a 2 MiB response cap; if it
is unavailable, the validator reports all original vulnerabilities.

Scope

This change does not alter SDK version policy or general OSV allowlisting.

[github-actions]

Signed commits report

1 of 1 commit between main and fix/filter-grafana-sdk-go-vulnerabilities could not be fully verified:

Commit	Author	Reason	Message
28a86039	alectimison-maker	unsigned	fix(osvscanner): filter Grafana Go SDK dependencies

This repository requires all commits to be signed. See GitHub docs on commit signature verification.

[cla-assistant]

All committers have signed the CLA.

[Copilot]

Pull request overview

This PR brings the Go (go.mod) OSV-scanner path in line with the existing JavaScript lockfile behavior by filtering out vulnerability findings that are inherited from the selected grafana-plugin-sdk-go version, while preserving findings that are direct plugin dependencies or version mismatches. It does so by parsing the plugin’s go.mod, resolving the chosen SDK version (including replace), fetching the SDK’s go.mod from the Go module proxy, and excluding findings only when the vulnerable module is indirect in the plugin and matches versions across plugin/SDK/OSV.

Changes:

• Route go.mod scans through a new Go-specific filtering path (filterGoModResults).
• Implement SDK-aware filtering by downloading and parsing the selected grafana-plugin-sdk-go module file.
• Add unit tests for the Go module filtering and fail-open behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/analysis/passes/osvscanner/filter.go	Enables Go module filtering by delegating go.mod handling to the new Go-specific filter.
pkg/analysis/passes/osvscanner/filter-gomod.go	Adds the Go module filtering implementation, including SDK version resolution and module-proxy fetch/parsing.
pkg/analysis/passes/osvscanner/filter_test.go	Adds tests covering Go module filtering behavior and fail-open behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.