The sigv4 README states the following:

This is a separate module from github.com/prometheus/common to prevent it from having and propagating a dependency on the AWS SDK.

This module is considered internal to Prometheus, without any stability guarantees for external usage.

The problem is that any attempt to import the github.com/prometheus/common/sigv4 package and running go get -u ./... brings over the dependency github.com/prometheus/common/sigv4 v0.1.0 which is the go.mod file of this module since its inception - 2021-06-23.

This module has not been tagged ever since.

As a result, even Prometheus itself is not using any of the changes to this module since the original tagging!
prometheus/prometheus go.mod
has the same github.com/prometheus/common/sigv4 v0.1.0 dependency.

Please tag and release this module on a regular basis. Thank you!
(Alternatively you can split this module out to a separate repository if this does not create circular dependency issues).