Go modules · proxy.golang.org

github.com/google/go-containerregistry/pkg/authn/k8schain

Go Mod Replace Local

Why PkgRadar flagged v0.0.0-20211228215442-99fe0b005a03

Severity	Signal	Evidence
medium	Go Mod Replace Local	—

Showing signal labels only. Sign in to view the exact matched indicators for each finding.

Scanned versions

Version	Verdict	Score	Scanned (UTC)
`v0.0.0-20211228215442-99fe0b005a03`	Review	10	2026-06-26
`v0.0.0-20260624172245-e8b2b9e51df6`	Low risk	0	2026-06-25
`v0.0.0-20260617220028-c68d89978269`	Low risk	0	2026-06-18
`v0.0.0-20260617193246-09fe1e55280a`	Low risk	0	2026-06-18
`v0.0.0-20260617164309-e9634975f4ac`	Low risk	0	2026-06-18
`v0.0.0-20260612174616-02649eab0d52`	Low risk	0	2026-06-13
`v0.0.0-20260612173422-7204b401d376`	Low risk	0	2026-06-13
`v0.0.0-20260611222238-4cfaa93eb444`	Low risk	0	2026-06-12

Block this in CI

PkgRadar gates github.com/google/go-containerregistry/pkg/authn/k8schain (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/google/go-containerregistry/pkg/authn/[email protected]