bdeshi
c87fed697b
go get marks a module indirect until something imports it, and the allowlist check only inspects direct requires — so an unapproved dependency could sit in go.mod unnoticed. Demonstrated: adding github.com/google/uuid passed the allowlist check and was caught only by this gate.