cmd/go: never remove the toolchain directive when tidying
- Dominant language
- Go
- Stars
- 139k
- Forks
- 19.4k
- PR merge metrics
- PR metrics pending
Description
When the `go` and `toolchain` directives are equal, `go mod tidy` removes the `toolchain` directive, which in my opinion, "removes the intent" of managing the toolchain version with the `go.mod` file.
When that happens, tools like dependency update automation (e.g. Dependabot, Renovate) will stop updating the Go version of the project (since the `go` directive is the minimal supported version, it is not usually desirable to update with the same frequency). And these tools will not add it back since they cannot tell whatever the user wishes to use `toolchain`, the "intent" has been removed.
The `go` directive often gets bump by `go mod tidy` when a dependency requires it, which happens fairly often.
The current behavior adds extra work for the user to keep an eye on the presence of the `toolchain` directive in their `go.mod` file, to add it back when there is a new release. Possibly allowing CVEs to accumulate if they do not notice or forget.
Basically, when a user has opted into using `toolchain`, they should never be opted out by `go mod tidy`.
Would that sound like reasonable change for `go mod tidy`?
Contributor guide
Research direction
Start by examining the cmd/go implementation of go mod tidy and how it handles equal go and toolchain directives. Confirm the behavior with the existing command tests, then ensure an explicitly present toolchain directive is retained after tidying and add coverage for the equal-directive case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100