We found the patch versions not appeared in Golang Index.

[Silence-worker-02]

Hello, we are a research team working on Golang. During our investigation, we discovered that the following CVEs - CVE-2022-31666, CVE-2022-31670, CVE-2022-31669, CVE-2022-31667, CVE-2020-29662, CVE-2019-19030, CVE-2019-16097 were addressed and the patch versions were released. However, we noticed that these patch versions have not appeared in the Golang Index, which means that 'go list' cannot automatically push the patch versions to downstream users.

We recommend that after releasing the versions, you push them to the Golang Index using the command 'go get github.com/goharbor/harbor@version'. This will enable the automatic distribution of the patch versions to downstream users. Thank you for your attention.

[zyyw]

Hey @Silence-worker-02, just curious why would you like to go get github.com/goharbor/harbor@version. In case, you want to interact with Harbor instance with your GoLang project, you may need to use go-swagger to generate a golang client code of harbor.
Reference:

• go.mod file still causing issues #18925