[Bug]: go.mod major-version mismatch breaks `go get` and forces insecure pseudo-versions
@aryangorwade is already working on this.
Since Aug 31, 2026.
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 552
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 90
Description
Describe the bug
The gpu-operator repository's go.mod declares the module as github.com/NVIDIA/gpu-operator (a v0/v1 path) even though release tags have moved to v23.x, v24.x, and beyond. Under Go's major-version suffix rule, any module at v2 or above must embed the major version in its module path (e.g. github.com/NVIDIA/gpu-operator/v24). Because this has not been done, downstream consumers cannot pin any released version with go get and are forced to reference arbitrary commits as pseudo-versions — a pattern that introduces real security and compliance risks.
To Reproduce
-
Attempt to add the latest released version as a dependency:
go get github.com/NVIDIA/gpu-operator@v24.x.y -
Observe the failure — Go cannot resolve the tag because the module path in
go.moddoes not carry the/v24suffix required by semver. -
The only working workaround is pinning a raw commit hash, which produces an unresolvable pseudo-version such as:
github.com/NVIDIA/gpu-operator v1.8.3-0.20260527175454-2369b0586cbd(base tag
v1.8.3, timestamp20260527175454, commit2369b0586cbd)
Expected behavior
Downstream consumers should be able to run:
go get github.com/NVIDIA/gpu-operator/v24@v24.x.y
and have Go resolve the dependency to the correct, signed release tag.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.