Seven Places to Fix One Bug

Last time I built a fleet-wide go mod why — build-time SBOMs loaded into a graph, so I could ask where an interesting dependency enters a fleet and along which paths. Pointed at gopkg.in/yaml.v3 and CVE-2022-28948 , it gave a clean answer: repos_naming_it, repos_reaching_it, repos_actually_importing_it 8, 7, 1 Seven repositories affected. One — platform-telemetry — actually contains the import…