govulncheck-action: Release current master to have tagged version utilizing the full commit SHAs of transitive actions

[nb-99]

Hi,

We are currently refactoring our actions to utilize full commit SHAs instead of tags. Using the SHA of the latest released version of golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee #v1.0.4 fails, because v1.0.4 brings transitive actions pinned to tags, not SHAs.
Could you release a v1.0.5 from current master so that Dependabot will properly pick up future updates and we can use a tag's commit SHA instead of the current master?

Thanks and best regards,
Niklas

[dmitshur]

CC @golang/vulndb, @catzkorn, @lufia.

[JaydipGabani]

+1, I am facing the same issue as well. 1.0.5 would really help.

[j-the-official]

+1 — also impacted by this. The Node 20 deprecation timeline adds urgency:

• 2026-06-02: GitHub will force Node 24 by default
• 2026-09-16: Node 20 removed from runners

@v1 users currently see deprecation warnings on every run because the tag points to v1.0.4 (Oct 2024) using actions/checkout@v4.1.1 and actions/setup-go@v5.0.0, both Node 20.

Master HEAD already has the fix (#8 merged Dec 2025), just needs a tag.

Workaround for now: pin to commit SHA 31f7c5463448f83528bd771c2d978d940080c9fd.

[Syndic]

+1 - Releasing current master as 1.0.5 would get rid of all the warnings (Node 20 deprecation) currently hitting my builds.