Go modules · proxy.golang.org

github.com/Open-Telemetry/opentelemetry-collector-contrib

Remote Payload, Go Mod Replace Local

Why PkgRadar flagged v0.23.1-0.20210329222335-aed9fa4fb5b7

Severity	Signal	Evidence
medium	Remote Payload	—
medium	Go Mod Replace Local	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.157.1-0.20260727032124-7f544651820e`	Low risk	0	2026-07-28
`v0.157.1-0.20260724142904-4c1583ccb5ed`	Low risk	0	2026-07-25
`v0.157.1-0.20260721180415-0afd7128e3e9`	Low risk	0	2026-07-22
`v0.157.0`	Low risk	0	2026-07-22
`v0.156.1-0.20260720010143-0bfa73e6f1b5`	Low risk	0	2026-07-21
`v0.156.1-0.20260717165556-e4b1bacda5e2`	Low risk	0	2026-07-18
`v0.155.0`	Low risk	0	2026-07-18
`v0.156.0`	Low risk	0	2026-07-18
`v0.23.1-0.20210329222335-aed9fa4fb5b7`	Review	4	2026-06-22
`v0.154.1-0.20260620130954-15b15bb4af71`	Low risk	0	2026-06-22
`v0.154.0`	Low risk	0	2026-06-22
`v0.153.1-0.20260530222110-f6db164e13d7`	Low risk	0	2026-06-01
`v0.0.1-test2`	Low risk

Block this in CI

PkgRadar gates github.com/Open-Telemetry/opentelemetry-collector-contrib (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/Open-Telemetry/opentelemetry-collector-contrib@v0.23.1-0.20210329222335-aed9fa4fb5b7