audit go mod replace

[colin-arnott-xero]

In go modules, replace directives are at best viral. They tend to make adoption, upgrades, and package management harder than GOPATH. They are intended as an escape hatch for development, not a longterm resolution, and should not really ever be contained within public facing modules intended for consumption.

As such, I would like to use this issue audit the current list of requires, track upstream fixes, and if possible remove them entirely:

go.mod#replace

// pinned to solo-io's fork of cue version 308aee4ff0928a8e0ec25b9cbbdc445264038463
// note(ilackarms): this replace must be shared in any skv2-based go module due to incompatibility with upstream versions of cue
cuelang.org/go => github.com/solo-io/cue v0.4.1-0.20210623143425-308aee4ff092
github.com/docker/docker => github.com/moby/moby v0.7.3-0.20190826074503-38ab9da00309
k8s.io/apimachinery => k8s.io/apimachinery v0.19.6
k8s.io/client-go => k8s.io/client-go v0.19.6

• cuelang.org/go
• github.com/docker/docker
• k8s.io/apimachinery
• k8s.io/client-go

[colin-arnott-xero]

cuelang.org/go

If solo-io is intending to hard fork cuelang.org/go, then this should become a full fork with a new module name, specifically github.com/solo-io/cue. (I am happy to assist.) Otherwise, can we document the issues that are being actively upstreamed?

github.com/docker/docker

There is no context given for what this is doing or why this is included.

k8s.io/...

It appears that we are pinning to an old version of kubernetes. This should no longer be necessary with go1.18 (or the correct exclude directives to ignore old versions of k8s.io/client-go.