The pattern to check the package and all subpackages for pretty much all Go tools is "./...". So:

  govulncheck ./...