👀

containerd/log doesn't seem to depend on yaml 🤔

Yeah, it's through testify;

go mod graph | grep ' gopkg.in/yaml.v3'
github.com/containerd/continuity gopkg.in/[email protected]
github.com/stretchr/[email protected] gopkg.in/[email protected]

Which is depended on through logrus;

go mod graph | grep ' github.com/stretchr/[email protected]'
github.com/sirupsen/[email protected] github.com/stretchr/[email protected]

Ah! I think I know what happened; it can be removed indeed. The v3.0.0-20200313102051-9f266ea9e77c -> v3.0.1 may have been either a manual bump (to prevent an old version with CVEs), or possibly stuck after it was updated indirectly. Go mod doesn't remove such lines automatically, but it doesn't add them back if you remove them manually; it's worth sometimes removing all the // indirect dependencies, and see if there's ones that are actually gone.

let me open a PR to get rid of it.