为符合 Go 模块要求,采用 /v8 主版本模块路径

1. False-Positive CVE Reports

Because vulnerability databases and scanners (Go Vuln DB, Trivy, Grype, Snyk, Dependabot, ZZTERM16ZZ's own security advisories) resolve Concourse through proxy.golang.org, they see the latest valid version as v4.2.3. Any CVEs fixed in v5–v8 are perpetually flagged as unpatched whenever downstream code or scanners evaluate the module. As @taylorsilva noted in PR #9701:

This would probably help with a bunch of CVE's that get flagged sometimes since we're not following this pattern. This is not a hypothetical — Issue #9560 ("Outdated Go dependencies with known CVEs") and Issue #8508 ("Dependency Dashboard") are direct consequences.

2. go install Is Broken for fly

Users cannot install fly via the standard Go toolchain:

$ go install ZZTERM20ZZ.com/concourse/concourse/[email protected]
# fails: go.mod has non-.../v8 module path

As documented in Issue #9682 (fly: macOS binaries are unsigned):