same things happens with npm and CVEs, most of the ones that bubble up aren't even called in my application so are no applicable.

go lang has a scanner [0] which only shows issues when the code actually calls the effected functions.

[0] https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck