Filter specific versions of a package
- Dominant language
- Go
- Stars
- 4.8k
- Forks
- 542
- Avg merge
- 7d 21h
- Merged PRs (30d)
- 2
Description
**Is your feature request related to a problem? Please describe.**
It would be useful to prevent specific versions of a packages from being downloaded, e.g. if a security vulnerability is discovered to be present in certain versions. From what I can tell, it used to be possible to filter specific versions of a package using a [filter file](https://docs.gomods.io/configuration/filter/#adding-versions-to-the-filter), but this mechanism is now deprecated. The currently supported solution of using a [download mode file](https://docs.gomods.io/configuration/download/) seems to operate at the package level without any ability to configure behavior for specific versions of the package.
**Describe the solution you'd like**
Ideally the download mode file would allow configuration to be applied to a range of versions for a particular package. I haven't thought too hard about the config structure but something along these lines:
```
download "golang.org/x/crypto" {
versions = ">=v0.25.0,
Contributor guide
Assessment
This issue has not been assessed yet.