Merge pull request #1377 from k4leung4/pin-vuln

update and use chainguard fork for vuln

go.mod

@@ -10,6 +10,9 @@ replace github.com/mholt/archiver/v3 => github.com/anchore/archiver/v3 v3.5.2
 // this is a breaking change, so we need to pin the version until glebarez/go-sqlite is updated to use internal/libc
 replace modernc.org/sqlite v1.33.0 => modernc.org/sqlite v1.32.0
 
+// Fork of the golang vuln to make private method public.
+replace golang.org/x/vuln => github.com/luhring/golang-vuln v1.1.3
+
 require (
 	chainguard.dev/apko v0.22.2
 	chainguard.dev/melange v0.18.1
@@ -380,5 +383,3 @@ require (
 	modernc.org/sqlite v1.34.2 // indirect
 	mvdan.cc/sh/v3 v3.10.0 // indirect
 )
-
-replace golang.org/x/vuln => github.com/luhring/golang-vuln v1.0.2-0.20231029212121-c364fd4725dc

go.sum

@@ -870,8 +870,8 @@ github.com/logrusorgru/aurora v2.0.3+incompatible h1:tOpm7WcpBTn4fjmVfgpQq0EfczG
 github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/luhring/golang-vuln v1.0.2-0.20231029212121-c364fd4725dc h1:xBZQlANkBN45jHwta/fZRXZLEkumSBMi6Y0FYyYHgBs=
-github.com/luhring/golang-vuln v1.0.2-0.20231029212121-c364fd4725dc/go.mod h1:bb2hMwln/tqxg32BNY4CcxHWtHXuYa3SbIBmtsyjxtM=
+github.com/luhring/golang-vuln v1.1.3 h1:PHkh+yVrhUvKsxIcpZ+1PV/03zseX+bCCe6ovfE+5B4=
+github.com/luhring/golang-vuln v1.1.3/go.mod h1:bb2hMwln/tqxg32BNY4CcxHWtHXuYa3SbIBmtsyjxtM=
 github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
 github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
 github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=