Review go mod dependencies before releases

Should be incorporated into release check list, so that e.g. an old version of stboot's lib is a deliberate choise rather than something that was forgotten.

Spotted by kai when bug fixing, thank you.