We found the patch versions not appeared in Golang Index.

[Silence-worker-02]

Hello, we are a research team working on Golang. During our investigation, we discovered that the following CVEs - CVE-2023-27591, CVE-2023-27592 - were addressed and the patch versions were released. However, we noticed that these patch versions have not appeared in the Golang Index.

We recommend that after releasing the versions, you push them to the Golang Index. This will enable the automatic distribution of the patch versions to downstream users. Thank you for your attention.

[fguillot]

We recommend that after releasing the versions, you push them to the Golang Index.

How?

[Silence-worker-02]

Thank you for providing additional information. Indeed, adhering to the Golang SemVer rules (https://go.dev/ref/mod#versions) is essential for version management in the Golang ecosystem. Following these rules ensures that version numbers are consistent and properly formatted.

Additionally, to push a specific version of a module to the Golang Index, the 'go get' command can be utilized in the following format: 'go get {module_name}@{module_version}'. This command allows developers to register the version with the Golang Index and make it accessible to other users and projects.

By following the Golang SemVer rules and utilizing the 'go get' command properly, maintainers can effectively manage module versions and improve the overall security and stability of their projects.