This point was brought up in In #637.

We might like to make a policy that osv-scanner will only use versions of Go, say at least two release behind. This will help consumers know how up-to-date their version of Go should be to be able to use this as a library and as a CLI tool.