AFAIK, Golang's module system (mentioned in the article) protects against this. From [1], The revision must be an ancestor of one of the module repository’s br

AFAIK, Golang's module system (mentioned in the article) protects against this. From [1], The revision must be an ancestor of one of the module repository’s branches or tags. This prevents attackers from referring to unapproved changes or pull requests. 1: https://go.dev/ref/mod https://go.dev/ref/mod