Go modules · proxy.golang.org

github.com/filecoin-project/lotus

Go Mod Replace Local

Why PkgRadar flagged v1.36.2

Severity	Signal	Evidence
medium	Go Mod Replace Local	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v1.36.2`	Review	10	2026-07-28
`v1.28.2-0.20260724092530-26daeaba70a2`	Review	10	2026-07-26
`v1.20.0-pre-rc.0.20230203204018-03b419e3d47f`	Review	10	2026-07-26
`v1.28.2-0.20260721100119-0aaac03f5468`	Review	10	2026-07-22
`v1.28.2-0.20260717053044-1335d0664b88`	Review	10	2026-07-20
`v1.28.0-rc5.0.20240726163715-f234267f1333`	Review	10	2026-07-20
`v1.28.2-0.20260717024056-ed8c6bfe128c`	Review	10	2026-07-18
`v0.3.1-0.20200527180016-75041b96e4ef`	Review	10	2026-07-17
`v1.28.2-0.20260714080131-67296741745f`	Review	10	2026-07-16
`v0.3.1-0.20200514210833-e9eaee6ef85f`	Review	10	2026-07-16
`v1.28.2-0.20260707081326-80a9830a2554`	Review	10	2026-07-10
`v0.0.0-20221114190655-af39ec27b8e1`	Review	10

Block this in CI

PkgRadar gates github.com/filecoin-project/lotus (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/filecoin-project/[email protected]