When issuing a minor Go release, we can consider patch updates that may be available to dependencies.

For example, suppose that Go 1.18.3 standard library uses golang.org/x/mod at version v1.5.0. When Go 1.18.4 minor release is going to be made, if there is version v1.5.1 of golang.org/x/mod published, it seems such an update should at very least be considered for inclusion (but v1.6.0 should not, at least not as part of this process).

This is the tracking issue to detect and consider such updates for inclusion in minor Go releases. This is likely best addressed as part of future release automation work (issues #40279, #29205). I'm not sure if it's realistic to automatically include such changes to minor releases without human review, so that'll still be needed, but everything else can likely be automated.

(This issue is factored out from a comment by @bcmills in third paragraph of comment on CL 256357.)

/cc @toothrot @cagedmantis @andybons