kvdb: remove redundant gogo protobuf replace
What the developer wrote
Authored by ziggie
kvdb: remove redundant gogo protobuf replace
Remove the nested kvdb module's self-replace for
github.com/gogo/protobuf now that the module graph selects v1.3.2
directly.
The Prometheus dependency graph was already updated in the previous
commit, so go mod tidy does not retain the old github.com/gogo/protobuf
v1.1.1 go.mod checksum.
What changed, and why it matters
This commit removes a now-unnecessary dependency override in a Go module file. The override was forcing the use of a newer, fixed version of the gogo/protobuf library, but the project's dependency graph now naturally selects that same fixed version, so the override is redundant. There is no functional code change and no security regression.
No action required. This is a benign dependency cleanup. Verify via `go mod graph` that github.com/gogo/protobuf resolves to v1.3.2 or later in the resulting module graph.
Security signals we found
Removal of a dependency replace directive that previously pinned a patched version of gogo/protobuf
Referenced OSV advisory GO-2021-0053 in removed comment
No functional code or dependency version change; the same patched version remains selected by the module graph
Evidence from the diff
The commit deletes a replace github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2 directive from kvdb/go.mod. The comment referenced OSV advisory GO-2021-0053, which affected gogo/protobuf v1.3.1. The Prometheus dependency graph was already updated in the prior commit, so go mod tidy no longer retains the old v1.1.1 checksum and the module graph now selects v1.3.2 directly. This is a cleanup of a redundant replace directive, not a downgrade or vulnerability introduction.
Changed components
kvdb/go.modInspect captured patch +0 / −4
diff --git a/kvdb/go.mod b/kvdb/go.mod
index 3c8d5ec..b23eb87 100644
--- a/kvdb/go.mod
+++ b/kvdb/go.mod
@@ -144,8 +144,4 @@ require (
// This replace is for https://github.com/advisories/GHSA-25xm-hr59-7c27
replace github.com/ulikunitz/xz => github.com/ulikunitz/xz v0.5.11
-// This replace is for
-// https://deps.dev/advisory/OSV/GO-2021-0053?from=%2Fgo%2Fgithub.com%252Fgogo%252Fprotobuf%2Fv1.3.1
-replace github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2
-
go 1.25.11
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.