x/pkgsite: package removal request for go.mongodb.org/mongo-driver/mongo @ 1.6.0, 1.6.1, 1.7.0 and 1.7.1

[benjirewis]

What is the path of the package that you would like to have removed?

We would like to remove go.mongodb.org/mongo-driver/mongo@v1.6.0, go.mongodb.org/mongo-driver/mongo@v1.6.1, go.mongodb.org/mongo-driver/mongo@v1.7.0, and go.mongodb.org/mongo-driver/mongo@v1.7.1. These are four versions of the MongoDB Go driver that are affected by a security bug.

Are you the owner of this package?

Yes, one of the couple co-owners.

What is the reason that you could not retract this package instead?

We would use a retract directive, but the MongoDB Go driver has to build on Golang version 1.10, which is lower than Golang 1.16. retract directives can only be used in the main module without error on Golang 1.16+, so our only option is to remove the affected versions manually.

[jamalc]

We only support removing all versions of a package or module by path. If we manually removed these versions from pkg.go.dev a user can still download them via go get and re-add them pkg.go.dev by looking them up on the site.

[benjirewis]

Got it; thank you for the update @jamalc.