Dependency has to be pinned to commit hash since tag is not a compatible semver supported by go.mod.
Godox is linter for TODOs and FIXMEs left in the code. Signed-off-by: Matous Dzivjak <matous.dzivjak@kiwi.com>