To bump some dependencies for CVE fixes, we added `replace` directives in the go.mod file. These dependencies have since moved way past the pinned version.
We should drop the replaces before we run into problems from having deps pinned to versions that are too old. For example, I've seen PRs with the following diff:

# golang.org/x/net v0.23.0 => golang.org/x/net v0.5.0

which is not really what we want.    

    4.16

    always

    1.
    2.
    3.
    

    Some dependencies are not upgraded because they are pinned.