zlacker

> The fact that it knows about github and the way that it's difficult to replace a dependency there with some other one including a local one.

Use `replace` in `go.mod`, or `go.work` if you're hacking on it locally?

>>hellco+(OP)
or go ahead and commit it, if you're galaxy brain and want to throw off would-be attackers trying to understand your codebase https://github.com/pulumi/pulumi/blob/v3.191.0/pkg/go.mod#L5 or https://github.com/opentofu/terraform-provider-aws/blob/main...