mrhid6
eee236a072
trivy-db, oras-go, the three version comparators and robfig/cron were recorded as indirect with an incomplete go.sum, which builds locally against a warm module cache but fails in CI with "updates to go.mod needed". trivy-db pulls testify into the build graph, and its hashes were missing entirely.