without any external dependencies

https://github.com/dnote/dnote/blob/master/go.mod
The project actually pulls in quite a few external modules.

trivy repo https://github.com/dnote/dnote --scanners vuln
# go.mod (gomod)
# Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 2, CRITICAL: 1)

But none of them appear to be exploitable or relevant in this context.

I don't think we should exclude it from the checks.
If it has external dependencies they should be kept somewhat up-to-date (or at least not be affected by a CRITICAL vulnerability, even if it's not exploitable).
Also the list already contains a few similar alternatives. I think we should remove it.