golang-jwt has False negative (missing vulnerability for package version)

[ngraham20]

github.com/golang-jwt/jwt/v4@v4.5.0 is vulnerable to CVE-2025-30204 per https://ossindex.sonatype.org/vulnerability/CVE-2025-30204 and GHSA-mh63-6h87-95cp, however when I scan my project, that CVE is not listed

❯ go list -m github.com/golang-jwt/jwt/v4
github.com/golang-jwt/jwt/v4 v4.5.0

❯ go list -m github.com/golang-jwt/jwt/v4 | nancy sleuth
pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.0
1 known vulnerabilities affecting installed version 
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ [CVE-2024-51744] CWE-755: Improper Handling of Exceptional Conditions                                                                                                                                                     ┃
┣━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Description        ┃ golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation                                                                                                                          ┃
┃                    ┃ of the error behavior in `ParseWithClaims` can lead to situation where                                                                                                                               ┃
┃                    ┃ users are potentially not checking errors in the way they should be.                                                                                                                                 ┃
┃                    ┃ Especially, if a token is both expired and invalid, the errors returned by                                                                                                                           ┃
┃                    ┃ `ParseWithClaims` return both error codes. If users only check for the                                                                                                                               ┃
┃                    ┃ `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded                                                                                                                               ┃
┃                    ┃ `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens.                                                                                                                           ┃
┃                    ┃ A fix has been back-ported with the error handling logic from the `v5`                                                                                                                               ┃
┃                    ┃ branch to the `v4` branch. In this logic, the `ParseWithClaims` function                                                                                                                             ┃
┃                    ┃ will immediately return in "dangerous" situations (e.g., an invalid                                                                                                                                  ┃
┃                    ┃ signature), limiting the combined errors only to situations where the                                                                                                                                ┃
┃                    ┃ signature is valid, but further validation failed (e.g., if the signature                                                                                                                            ┃
┃                    ┃ is valid, but is expired AND has the wrong audience). This fix is part of                                                                                                                            ┃
┃                    ┃ the 4.5.1 release. We are aware that this changes the behaviour of an                                                                                                                                ┃
┃                    ┃ established function and is not 100 % backwards compatible, so updating to                                                                                                                           ┃
┃                    ┃ 4.5.1 might break your code. In case you cannot update to 4.5.0, please                                                                                                                              ┃
┃                    ┃ make sure that you are properly checking for all errors ("dangerous" ones                                                                                                                            ┃
┃                    ┃ first), so that you are not running in the case detailed above.                                                                                                                                      ┃
┣━━━━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ OSS Index ID       ┃ CVE-2024-51744                                                                                                                                                                                       ┃
┣━━━━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ CVSS Score         ┃ 2.3/10 (Low)                                                                                                                                                                                         ┃
┣━━━━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ CVSS Vector        ┃ CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N                                                                                                                                      ┃
┣━━━━━━━━━━━━━━━━━━━━╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Link for more info ┃ https://ossindex.sonatype.org/vulnerability/CVE-2024-51744?component-type=golang&component-name=github.com%2Fgolang-jwt%2Fjwt%2Fv4&utm_source=nancy-client&utm_medium=integration&utm_content=1.0.50 ┃
┗━━━━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

1 Vulnerable Packages

┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Summary                     ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━┫
┃ Audited Dependencies    ┃ 1 ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━╋━━━┫
┃ Vulnerable Dependencies ┃ 1 ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━┻━━━┛

I would have expected CVE-2025-30204 to additionally show up in this list