Description:
When go.mod is used for version discovery it will download the exact version that's specified in the file. This means that even if there are known vulnerabilities in Go it still will be used.
Justification:
Always use the latest bugfix release to prevent using and generating vulnerable code.
Are you willing to submit a PR?
Yes