vulncheck-example/unusedvulndep/module.go

// Unusedvulndep is a package that imports golang.org/x/crypto package
// with vulnarability https://pkg.go.dev/vuln/GO-2023-2402 and provides
// function that is not affected by vulnarability
package unusedvulndep

import (
	"golang.org/x/crypto/ssh"
)

// FunctionWithVulnarability is a nop function that transitively adds
// vulnarable dependency but unvunarable code to a call trace of
// your application
func FunctionWithoutVulnarability() error {
	var s ssh.Signer
	_, err := ssh.NewCertSigner(new(ssh.Certificate), s)
	return err
}