Merged in five days, open in seven hundred
Leaving a healthy dependency: cockroachdb/errors predates Go 1.20, so its Join hides the aggregate and everything below it goes missing.
Tags
3 pages
Dependencies
Nobody's coming to clean your supply chain
Signed but poisoned packages show a signature proves who sent something, not what is in it. Nobody is coming to clean this up for you.
The blank import that keeps a dependency out of your binary
Making OS-keychain support provably absent from a Go binary for regulated or air-gapped builds, using a registry and a blank import.
