gomods / gomods/athens

Filter specific versions of a package

Open
#2,015 3 comments 0 reactions 0 assignees View on GitHub
proposal
Dominant language
Go
Stars
4.8k
Forks
542
Avg merge
7d 21h
Merged PRs (30d)
2

Description

**Is your feature request related to a problem? Please describe.**
It would be useful to prevent specific versions of a packages from being downloaded, e.g. if a security vulnerability is discovered to be present in certain versions. From what I can tell, it used to be possible to filter specific versions of a package using a [filter file](https://docs.gomods.io/configuration/filter/#adding-versions-to-the-filter), but this mechanism is now deprecated. The currently supported solution of using a [download mode file](https://docs.gomods.io/configuration/download/) seems to operate at the package level without any ability to configure behavior for specific versions of the package.

**Describe the solution you'd like**
Ideally the download mode file would allow configuration to be applied to a range of versions for a particular package. I haven't thought too hard about the config structure but something along these lines:
```
download "golang.org/x/crypto" {
versions = ">=v0.25.0,

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.