search

chainguard-dev / gobump

Go tool to declaratively bump dependencies.
Apache License 2.0
7 stars 11 forks source link

feat: gobump should error when in the list of dependencies are some old version #8

Closed hectorj2f closed 9 months ago

hectorj2f commented 10 months ago

At the end of the bump, we run go mod tidy this might upgrade some of the dependencies defined in gobump.deps. If that happens, gobump could error and suggest a new list of dependencies without that one that got updated. This could help to keep a healthy list of deps until we integrate Ariadne's work.

hectorj2f commented 9 months ago

This work won't be needed. We will add a logic to the wolfi-bot during updates that will clean the unused deps.