I just went through this exact process (not for the first time) two weeks ago with a bug in the golang standard library. Fun times. Deep in the dependency stack of a container build my team doesn’t own so who knows when I’ll get a fixed version.