I think Go modules version resolution opting for *lowest* common release rather ...

		donatj on April 11, 2022 \| parent \| context \| favorite \| on: Node.js packages don't deserve trust I think Go modules version resolution opting for lowest common release rather than the standard highest is a reasonable and sane option though not a total solution. It prevents users of your library from pulling unvetted versions of your dependencies just by pulling your library alone.

https://go.dev/blog/supply-chain is a very good write-up on this topic too.