Unable to replace github.com/dgrijalva/jwt-go with github.com/golang-jwt/jwt/[email protected] #435
Description
I have a golang module that uses some 3rd party packages that still use github.com/dgrijalva/jwt-go
As a result, I am adding a replace directive to refer to github.com/golang-jwt/jwt/v4 instead.
It looked like this in go.mod file,
replace github.com/dgrijalva/jwt-go v3.2.0+incompatible => github.com/golang-jwt/jwt/v4 v4.4.2
Recently discovered some vulnerabilities which have been fixed in v4.5.2 so edited the replace directive to look like this
replace github.com/dgrijalva/jwt-go v3.2.0+incompatible => github.com/golang-jwt/jwt/v4 v4.5.2
But with this change, when I run go mod tidy, I see the below error,
go: github.com/golang-jwt/jwt/[email protected] used for two different module paths (github.com/dgrijalva/jwt-go and github.com/golang-jwt/jwt/v4)
I tried with v4.5.1, it works fine (but has a vulnerability, so can't use it). The issue is just with v4.5.2
Kindly help, thanks!