Codecov Report

Merging #637 (04ca816) into main (f08125b) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #637   +/-   ##
=======================================
  Coverage   78.82%   78.82%           
=======================================
  Files          78       78           
  Lines        5511     5511           
=======================================
  Hits         4344     4344           
  Misses        990      990           
  Partials      177      177           

Can you also change the go version in the go.mod?

Isn't this a breaking change though for the library?

I was thinking about that, but it looks like go 1.19 is out of support anyway? https://endoflife.date/go

I'm actually not sure how libraries are suppose to bump versions if we have to do a major version change every go release.

I thought it that libraries don't need to worry EOL because that only matters for the version of Go that is doing the compiling - i.e. osv-scanner (the cli) should be being built with an in-life version of Go, but osv-scanner (the library) can remain compatible with EOL version of Go

I opt for upgrading the version of Go. And that this shouldn't require a major version bump.

• Go is backwards compatible, upgrading is encouraged by the Go project. Upgrading should be a good thing and easy to do. I don't think it makes sense for osv-scanner to support people stuck at Go 1.19.
• I don't think osv-scanner should only use old features of Go until a major version bump. This is much more like a minor change.

However, we might like to make a policy that osv-scanner will user versions of Go at least two release behind or something.
#638