PkgRadar

Go modules · proxy.golang.org

go.etcd.io/etcd/pkg/v3

Go Mod Replace Local: go.mod replace directive redirects to a local filesystem path — non-portable / dev-time only.

Why PkgRadar flagged v3.8.0-alpha.0.0.20260609110845-d68ac12a73a6

SeveritySignalEvidence
mediumGo Mod Replace Localgo.mod replace directive redirects to a local filesystem path — non-portable / dev-time only. · go.etcd.io/etcd/pkg/[email protected]/go.mod

Scanned versions

VersionVerdictScoreScanned (UTC)
v3.8.0-alpha.0.0.20260609110845-d68ac12a73a6Review102026-06-10
v3.8.0-alpha.0.0.20260607061426-ab4ac34206deReview102026-06-09
v3.5.32-0.20260604162031-3a9e888fefbbLow risk02026-06-09
v3.8.0-alpha.0.0.20260605092252-038d4c1085a1Review102026-06-06
v3.8.0-alpha.0Review102026-06-06
v3.7.0-rc.0Review102026-06-02
v3.5.31Low risk02026-06-02
v3.5.31-0.20260528081745-75bb96d29db3Low risk02026-06-02

Block this in CI

PkgRadar gates go.etcd.io/etcd/pkg/v3 (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem go go.etcd.io/etcd/pkg/[email protected]