It seems that when allowing only $gostd, any package which domain name starts with an std go package name will be allowed

[apostasie]

Title says all.

package main

import (
	"go.opentelemetry.io/otel/metric"
	"gotest.tools/v3/assert"
         "go.evil.me/whatever"
         "fmt.evil.me/whateverelse"
)

If you allow $gostd, depguard will be happy with this ^.

I assume this comes from the way comparison is done in: https://github.com/OpenPeeDeeP/depguard/blob/v2/settings.go#L224C6-L240

Am I misunderstanding something here?

Let me know your thoughts.

[dixonwille]

Sorry for the wait for a response, I believe I do a prefix match. For example you import "fmt" or "os/exec". I'll see if I can come up with something that pervents domain_name.tld when looking at $gostd packages.