x/vuln: Missing output message when no vulnerabilities are found

[samstride]

What version of Go are you using (go version)?

$ go version go1.20.6 linux/arm64

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="arm64"
GOBIN=""
GOCACHE="/home/vscode/.cache/go-build"
GOENV="/home/vscode/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_arm64"
GOVCS=""
GOVERSION="go1.20.6"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/workspaces/"
GOWORK="/workspaces//go.work"
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1204719484=/tmp/go-build -gno-record-gcc-switches"

govulncheck v0.1.0 outputs the message No vulnerabilities found. when no vulnerabilities are found.

go install golang.org/x/vuln/cmd/govulncheck@v0.1.0

govulncheck ./...
govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Using go1.20.6 and govulncheck@v0.0.0 with
vulnerability data from https://vuln.go.dev (last modified 2023-07-11 19:19:08 +0000 UTC).

Scanning your code and 326 packages across 40 dependent modules for known vulnerabilities...
No vulnerabilities found.

govulncheck v0.2.0 does not output the message No vulnerabilities found. when no vulnerabilities are found.

go install golang.org/x/vuln/cmd/govulncheck@v0.2.0

govulncheck ./...
govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback.

Using go1.20.6
 and govulncheck@v0.2.0 with vulnerability data from https://vuln.go.dev (last modified 2023-07-11 19:19:08 +0000 UTC).

Scanning your code and 326 packages across 40 dependent modules for known vulnerabilities...

Just checking to see if this is the expected behaviour of v0.2.0?

Thanks.

[gopherbot]

Change https://go.dev/cl/508920 mentions this issue: internal/scan: print the summary even when there are no findings