internal/report/lint.go (4 lines):
	- line 23: // TODO: getting things from the proxy should all be cached so we
	- line 96: // TODO: for now, just skip pseudo-versions. at some point we should verify that
	- line 167: // TODO: It might make sense to include warnings or informational things
	- line 258: // TODO: may just want to use one of these? :shrug:


internal/report/report.go (2 lines):
	- line 51: // TODO: could also be GoToolchain, but we might want
	- line 57: // TODO: the most common usage of additional package should


cmd/vulnreport/main.go (1 line):
	- line 124: const todo = "TODO: fill this out"