fix(gomod): prefer version specified by toolchain directive when present

extractor/filesystem/language/golang/gomod/gomod.go

@@ -129,6 +129,17 @@ func (e Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) ([]
 		}
 	}
 
+	// Give the toolchain version priority, if present
+	if parsedLockfile.Toolchain != nil && parsedLockfile.Toolchain.Name != "" {
+		version, _, _ := strings.Cut(parsedLockfile.Toolchain.Name, "-")
+
+		packages[mapKey{name: "stdlib"}] = &extractor.Inventory{
+			Name:      "stdlib",
+			Version:   strings.TrimPrefix(version, "go"),
+			Locations: []string{input.Path},
+		}
+	}
+
 	// The map values might have changed after replacement so we need to run another
 	// deduplication pass.
 	dedupedPs := map[mapKey]*extractor.Inventory{}

extractor/filesystem/language/golang/gomod/gomod_test.go

@@ -120,6 +120,42 @@ func TestExtractor_Extract(t *testing.T) {
 				},
 			},
 		},
+		{
+			Name: "toolchain",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/toolchain.mod",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "github.com/BurntSushi/toml",
+					Version:   "1.0.0",
+					Locations: []string{"testdata/toolchain.mod"},
+				},
+				{
+					Name:      "stdlib",
+					Version:   "1.23.6",
+					Locations: []string{"testdata/toolchain.mod"},
+				},
+			},
+		},
+		{
+			Name: "toolchain with suffix",
+			InputConfig: extracttest.ScanInputMockConfig{
+				Path: "testdata/toolchain-with-suffix.mod",
+			},
+			WantInventory: []*extractor.Inventory{
+				{
+					Name:      "github.com/BurntSushi/toml",
+					Version:   "1.0.0",
+					Locations: []string{"testdata/toolchain-with-suffix.mod"},
+				},
+				{
+					Name:      "stdlib",
+					Version:   "1.23.6",
+					Locations: []string{"testdata/toolchain-with-suffix.mod"},
+				},
+			},
+		},
 		{
 			Name: "indirect packages",
 			InputConfig: extracttest.ScanInputMockConfig{

extractor/filesystem/language/golang/gomod/testdata/toolchain-with-suffix.mod

@@ -0,0 +1,9 @@
+module my-library
+
+go 1.23.5
+
+toolchain go1.23.6-xyz
+
+require (
+	github.com/BurntSushi/toml v1.0.0
+)

extractor/filesystem/language/golang/gomod/testdata/toolchain.mod

@@ -0,0 +1,9 @@
+module my-library
+
+go 1.23.5
+
+toolchain go1.23.6
+
+require (
+	github.com/BurntSushi/toml v1.0.0
+)