PkgRadar

Go modules · proxy.golang.org

github.com/hashicorp/nomad

Remote Payload: matched "curl "

Why PkgRadar flagged v0.0.0-20221106140601-233092157f5f

SeveritySignalEvidence
mediumRemote Payloadmatched "curl " · github.com/hashicorp/[email protected]/command/operator_api.go
mediumGo Mod Replace Localgo.mod replace directive redirects to a local filesystem path — non-portable / dev-time only. · github.com/hashicorp/[email protected]/go.mod

Scanned versions

VersionVerdictScoreScanned (UTC)
v0.0.0-20221106140601-233092157f5fReview302026-06-04
v1.11.0-rc.1.0.20260602193300-ee4200e157e4Review472026-06-03
v0.0.0-20260602193300-ee4200e157e4Review472026-06-03
v1.11.0-rc.1.0.20260602124506-f5da8af50296Review472026-06-03
v0.0.0-20260602124506-f5da8af50296Review472026-06-03
v0.0.0-20260511152149-cd7240c4099aReview472026-06-03
v0.0.0-20260601151532-de94093145caReview472026-06-02
v0.0.0-20260601141707-c8ccecd78b6bReview472026-06-02
v0.0.0-20250425125325-3e688cf9282fReview472026-06-02
v0.0.0-20260528135333-5b027732945fReview472026-05-29
v1.11.0-rc.1.0.20260528135333-5b027732945fReview472026-05-29
v0.0.0-20260417125653-3fb193db3636Review472026-05-29
v0.0.0-20260319134420-fbcc62a8965fReview472026-05-29

Block this in CI

PkgRadar gates github.com/hashicorp/nomad (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go github.com/hashicorp/[email protected]