Go modules · proxy.golang.org

github.com/charmbracelet/gum

Go Mod Replace Local

Why PkgRadar flagged v0.14.4-0.20240819150002-19a93b08b97e

Severity	Signal	Evidence
medium	Go Mod Replace Local	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.14.4-0.20240725195829-7e56d57478d1`	Low risk	0	2026-08-23
`v0.14.4-0.20240821183944-dd5aa97c4a45`	Low risk	0	2026-08-23
`v0.14.4-0.20240819150002-19a93b08b97e`	Review	10	2026-08-23
`v0.14.4-0.20240725140256-8422c4901811`	Low risk	0	2026-08-23
`v0.14.4-0.20240725194513-9db5c7fbbaba`	Low risk	0	2026-08-23
`v0.14.4-0.20240725171230-046a4d361eb1`	Low risk	0	2026-08-23
`v0.14.4-0.20240725195022-d722a2f1b811`	Low risk	0	2026-08-23
`v0.14.4-0.20240819145901-e095a9142b74`	Review	10	2026-08-23
`v0.17.1-0.20260820072550-4f904647703a`	Low risk	0	2026-08-21
`v0.17.1-0.20260817210622-f6dd28ec27d5`	Low risk	0	2026-08-18
`v0.14.6-0.20241126165327-f61d1007136e`	Low risk	0	2026-08-15
`v0.6.1-0.20220908142618-2f165cdfb908`	Low risk

Block this in CI

PkgRadar gates github.com/charmbracelet/gum (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/charmbracelet/[email protected]

Prefer zero config? Install the GitHub App and it gates every pull request automatically — no pipeline edits, no API key.