What the developer wrote
Authored by ziggie
mod: remove redundant gogo protobuf replace
The main module already requires github.com/gogo/protobuf v1.3.2, which
is the fixed and latest tagged version. Go's MVS continues to select
v1.3.2 without the self-replace, so the replace no longer changes the
effective dependency version.
Running go mod tidy records an older transitive go.mod checksum, but go
list still resolves github.com/gogo/protobuf to v1.3.2.
What changed, and why it matters
This commit removes a now-unnecessary override in the project's dependency file. The override was originally added to force the use of a fixed version of the gogo/protobuf library, but the project already directly requires that fixed version, so the override had no practical effect. The effective dependency version remains unchanged, and no security-relevant behavior changes.
No action required. Verify in CI that `go list -m github.com/gogo/protobuf` still reports v1.3.2 and that the build/test suite passes. Consider documenting that the direct require already satisfies the advisory requirement.
Security signals we found
Removes a dependency replace that was originally introduced for a security advisory (GO-2021-0053 / GHSA affecting gogo/protobuf v1.3.1)
Effective dependency version remains the patched v1.3.2, so the previously addressed vulnerability is still mitigated
Evidence from the diff
The commit deletes a replace github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2 directive from go.mod. The main module already has a direct require github.com/gogo/protobuf v1.3.2, so Go’s Minimal Version Selection (MVS) resolves to v1.3.2 with or without the replace. go.sum gains an older transitive checksum (v1.1.1) because the replace previously masked it, but the resolved effective version stays v1.3.2. This is a cleanup, not a functional or security change.
Changed components
go.modgo.sumInspect captured patch +1 / −4
diff --git a/go.mod b/go.mod
index 0a0baeb..9f54e67 100644
--- a/go.mod
+++ b/go.mod
@@ -203,10 +203,6 @@ replace github.com/lightningnetwork/lnd/sqldb => ./sqldb
// This replace is for https://github.com/advisories/GHSA-25xm-hr59-7c27
replace github.com/ulikunitz/xz => github.com/ulikunitz/xz v0.5.11
-// This replace is for
-// https://deps.dev/advisory/OSV/GO-2021-0053?from=%2Fgo%2Fgithub.com%252Fgogo%252Fprotobuf%2Fv1.3.1
-replace github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2
-
// We want to format raw bytes as hex instead of base64. The forked version
// allows us to specify that as an option.
replace google.golang.org/protobuf => github.com/lightninglabs/protobuf-go-hex-display v1.33.0-hex-display
diff --git a/go.sum b/go.sum
index ce8cc7e..355b11d 100644
--- a/go.sum
+++ b/go.sum
@@ -175,6 +175,7 @@ github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/me
github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.