PkgRadar

Go modules · proxy.golang.org

git.apache.org/thrift.git/lib/go/test

Go Mod Replace Local: go.mod replace directive redirects to a local filesystem path — non-portable / dev-time only.

Why PkgRadar flagged v0.0.0-20260611205715-35c1a53dd6de

SeveritySignalEvidence
mediumGo Mod Replace Localgo.mod replace directive redirects to a local filesystem path — non-portable / dev-time only. · git.apache.org/thrift.git/lib/go/[email protected]/go.mod

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.0.0-20260611205715-35c1a53dd6deReview102026-06-12
v0.0.0-20260608211012-37925920f03aReview102026-06-10
v0.0.0-20260606163542-73a168bed349Review102026-06-08
v0.0.0-20260603211227-208b779bc98cReview102026-06-06
v0.0.0-20260603002616-318212b93859Review102026-06-04
v0.0.0-20260530222330-5e29f31685b6Review102026-06-01
v0.0.0-20260529002519-1ffdcf24e4abReview102026-05-30

Block this in CI

PkgRadar gates git.apache.org/thrift.git/lib/go/test (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go git.apache.org/thrift.git/lib/go/[email protected]