Question about some suspect dependencies of "go-jose"

[pintarj]

I'm quite new to Go and I have some issues with module dependencies in my project. While trying to figure out what's the problem I found out that in the go.mod of the go-jwks repository there are two (to me) suspect lines:

require(
  // ...
  github.com/square/go-jose v2.6.0+incompatible
  // ...  
  gopkg.in/square/go-jose.v2 v2.3.1 // indirect
)

They are targeting the same module, but with different versions and on different package registries (github.com and gopkg.in). Furthermore (as far as I can see) the gopkg.in/square/go-jose.v2 is never user inside the code of the repository.

Is this intentional? Cause I think that this could be the problem that is breaking my code.