chainguard-dev / chainguard-dev/sdk

Stop bumping go directive unless necessitated by other dependencies

Open
#147 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
2
Forks
26
PR merge metrics
No merged PRs in 30d

Description

@kaovilai ➜ /workspaces/sdk (961a644) $ go mod graph | grep go@1.23.3 | cut -d ' ' -f 2
go@1.23.3
toolchain@go1.23.3
@kaovilai ➜ /workspaces/sdk (961a644) $ go mod graph | grep go@1.23. | grep -v /sdk | cut -d ' ' -f 2
go@1.23.2
go@1.23.1
toolchain@go1.23.3

Per above, this repo go.mod as it currently stands should have go directive of 1.23.2, not 1.23.3.

This repo by itself should not be enforcing minimum on other repositories importing it. Stop spreading "minimum virus"

toolchain version used will be defined outside of go.mod ideally, such as by installing a newer compatible go toolchain to ci/cd/development env.

Failing that, toolchain directive should be used instead of go directive for bumping versions to not cascade minimum versions to importing dependencies.

toolchain directive, in contrast to the go directive, applies only to the current module (the one defined by the go.mod file). It suggests the toolchain to be used when in that very module, and doesn't propagate to other modules.

High profile repos that have removed/reduced minimum go patch version per user requests

Being proactive to prevent following from reoccuring

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with go.mod and reproduce the issue's go mod graph commands to compare the repository's go directive with dependency requirements. Review the Go module and toolchain directive behavior, then verify that the module does not impose an unnecessary patch-version minimum on importing modules and that the dependency graph remains valid.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system
Issue type
Refactor
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.