golang / golang/go

cmd/go: never remove the toolchain directive when tidying

Open
#75,331 6 comments 16 reactions 0 assignees View on GitHub
GoCommand NeedsInvestigation ToolProposal
Dominant language
Go
Stars
139k
Forks
19.4k
PR merge metrics
PR metrics pending

Description

When the `go` and `toolchain` directives are equal, `go mod tidy` removes the `toolchain` directive, which in my opinion, "removes the intent" of managing the toolchain version with the `go.mod` file.

When that happens, tools like dependency update automation (e.g. Dependabot, Renovate) will stop updating the Go version of the project (since the `go` directive is the minimal supported version, it is not usually desirable to update with the same frequency). And these tools will not add it back since they cannot tell whatever the user wishes to use `toolchain`, the "intent" has been removed.

The `go` directive often gets bump by `go mod tidy` when a dependency requires it, which happens fairly often.

The current behavior adds extra work for the user to keep an eye on the presence of the `toolchain` directive in their `go.mod` file, to add it back when there is a new release. Possibly allowing CVEs to accumulate if they do not notice or forget.

Basically, when a user has opted into using `toolchain`, they should never be opted out by `go mod tidy`.

Would that sound like reasonable change for `go mod tidy`?

Contributor guide

Open the contributing guide

Research direction

Start by examining the cmd/go implementation of go mod tidy and how it handles equal go and toolchain directives. Confirm the behavior with the existing command tests, then ensure an explicitly present toolchain directive is retained after tidying and add coverage for the equal-directive case.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.