Git dependency not reachable: not referenced in the package nor does it exist?

[conorevans]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

go:modules

Package manager version

1.22.2

Language version

1.22.2

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: gomod
    directory: /
    schedule:
      interval: daily
    open-pull-requests-limit: 5
    registries:
      - github
registries:
  github:
    type: git
    url: https://github.com
    username: XXX
    password: ${{ secrets.XXXX }}

Updated dependency

go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc

What you expected to see, versus what you actually saw

updater | 2024/07/05 03:26:02 INFO <job_851725652> Checking if go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.52.0 needs updating
  proxy | 2024/07/05 03:26:03 [087] GET https://go.opentelemetry.io:443/contrib/instrumentation/google.golang.org/grpc/otelgrpc?go-get=1
...
updater | 2024/07/05 03:26:05 INFO <job_851725652> Updating go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.52.0 to 0.53.0
...
  proxy | 2024/07/05 03:45:52 [123] WARN: Cannot write TLS response body from mitm'd client: write tcp 192.168.1.1:1080->192.168.1.2:43222: write: connection reset by peer
updater | 2024/07/05 03:45:52 INFO <job_851725652> Handled error whilst updating go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc: git_dependencies_not_reachable {:"dependency-urls"=>["github.com/unchartedsoftware/witch"]}
...
updater | Dependabot encountered '9' error(s) during execution, please check the logs for more details.
updater | +--------------------------------------------------------------------------------------------------------------+
updater | |                                        Dependencies failed to update                                         |
updater | +-----------------------------------------------------------------------------+--------------------------------+
updater | | go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc | git_dependencies_not_reachable |
updater | | github.com/popsa-hq/XXX                                             | git_dependencies_not_reachable |
updater | | google.golang.org/grpc                                                      | git_dependencies_not_reachable |
updater | | go.opentelemetry.io/otel                                                    | git_dependencies_not_reachable |
updater | | go.opentelemetry.io/otel/exporters/zipkin                                   | git_dependencies_not_reachable |
updater | | golang.org/x/mod                                                            | git_dependencies_not_reachable |
updater | | github.com/aws/aws-sdk-go                                                   | git_dependencies_not_reachable |
updater | | go.opentelemetry.io/otel/trace                                              | git_dependencies_not_reachable |
updater | | go.opentelemetry.io/otel/sdk                                                | git_dependencies_not_reachable |
updater | +-----------------------------------------------------------------------------+--------------------------------+
updater | time="2024-07-05T03:47:43Z" level=info msg="task complete" container_id=job-851725652-updater exit_code=0 job_id=851725652 step=updater

I can find a go.dev package https://pkg.go.dev/github.com/unchartedsoftware/witch which links out to https://github.com/unchartedsoftware/witch which indeed doesn't exist but I don't it referenced in any of the dependencies?

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

Included in the failures is a private package which is quite small and for which I've attached the go.sum and go.mod - no reference to this witch package

module github.com/popsa-hq/XXX

go 1.20

require go.uber.org/zap v1.27.0

require (
	github.com/stretchr/testify v1.8.4 // indirect
	go.uber.org/multierr v1.10.0 // indirect
)

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ=
go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

Smallest manifest that reproduces the issue

No response