govulncheck reports vulnerable github.com/ulikunitz/xz in called code #219

simplehttpserver version:

main at 92eea8b

Current Behavior:

govulncheck reports GO-2025-3922 in github.com/ulikunitz/xz among the vulnerabilities the code calls:

Vulnerability #2: GO-2025-3922
    Memory leaks when decoding a corrupted multiple LZMA archives in
    github.com/ulikunitz/xz
  More info: https://pkg.go.dev/vuln/GO-2025-3922
  Module: github.com/ulikunitz/xz
    Found in: github.com/ulikunitz/xz@v0.5.7
    Fixed in: github.com/ulikunitz/xz@v0.5.15

Expected Behavior:

govulncheck reports no reachable vulnerabilities in github.com/ulikunitz/xz.

Steps To Reproduce:

1. Check out main at 92eea8b.

2. Run govulncheck (v1.9.0 with go1.27.3 here):

   go run golang.org/x/vuln/cmd/govulncheck@latest ./...

Anything else:

With -show verbose, the scan also lists GO-2020-0016 for the same module (found in github.com/ulikunitz/xz@v0.5.7, fixed in v0.5.8) under imported packages that the code doesn't call.

The scan reports three more called vulnerabilities that have no fixed version: GO-2025-4020 in github.com/nwaples/rardecode@v1.1.0, and GO-2025-3605 and GO-2024-2698 in github.com/mholt/archiver@v3.1.1+incompatible. This report covers only the xz findings.