x/vuln: go: -mod may only be set to readonly when in workspace mode, but it is set to "mod" error starting in 1.0.2

[ldemailly]

git clone https://github.com/fortio/fortiotel.git
cd fortiotel

then:

$ go install golang.org/x/vuln/cmd/govulncheck@v1.0.1
$ govulncheck ./...
Scanning your code and 342 packages across 34 dependent modules for known vulnerabilities...

No vulnerabilities found.

Share feedback at https://go.dev/s/govulncheck-feedback.

vs

$  go install golang.org/x/vuln/cmd/govulncheck@latest
go: downloading golang.org/x/vuln v1.0.2
go: downloading golang.org/x/tools v0.17.0
go: downloading golang.org/x/sync v0.6.0
$ govulncheck ./...
govulncheck: loading modules: /opt/homebrew/bin/go list -m -json -mod=mod all: exit status 1
go: -mod may only be set to readonly when in workspace mode, but it is set to "mod"
	Remove the -mod flag to use the default readonly value,
	or set GOWORK=off to disable workspace mode.

[ldemailly]

Duplicate of #65130

[gopherbot]

Change https://go.dev/cl/556775 mentions this issue: internal/vulncheck: remove -mod=mod flag from LoadModules