search

chainguard-dev / gobump

Go tool to declaratively bump dependencies.
Apache License 2.0
7 stars 11 forks source link

fix: handle deps that also appear in replaces blocks in the go.mod #19

Closed hectorj2f closed 9 months ago

hectorj2f commented 9 months ago

With the new version of gobump, we drop any replacement and require block of a dependency we want to add as require or replace.

However when we add a dep to the deps and this dependency appears on a replace block in the go.mod. We need to use the old.path of the dependency to be able to drop the existing replacement and use the proposed dep bump.

gobump --packages=golang.org/x/crypto@v1.17.0

To give an example, keda-2.9 has a replacement of the crypto dep that we want to bump https://github.com/kedacore/keda/blob/v2.9.1/go.mod#L99 and it also appears on a require block https://github.com/kedacore/keda/blob/v2.9.1/go.mod#L271. If we need to change the go.mod to use the new dep version, we need to drop the replace and require.