Dependencies with security issues aren't flagged #156
Description
The security scan done post-release finds issues (such as CVEs from Go) but we don't seem to have anything that identifies those earlier (even Dependabot should be able to do this, I think).
It would be far better to be aware of these before someone reports them to us, and before we cut a release.