search

sillygod / cdp-cache

a caddy 2 proxy cache plugin
MIT License
119 stars 17 forks source link

Dependency version inconsistency #58

Open Ben131-Go opened 1 year ago

Ben131-Go commented 1 year ago

It is a reminder of dependency version inconsistency introduced by replace directive used in github.com/caddyserver/caddy@v2.4.6.

Dependency line:

github.com/sillygod/cdp-cache --> github.com/caddyserver/caddy --> ... --> github.com/manifoldco/promptui
github.com/caddyserver/caddy v2.4.6 --> github.com/manifoldco/promptui 70ccd47
https://github.com/caddyserver/caddy/blob/v2.4.6/go.mod#L39

Background

Repo github.com/caddyserver/caddy at version v2.4.6 uses replace directive to pin dependency github.com/manifoldco/promptui to version 70ccd47.
According to Go Modules wikis, replace directives in modules other than the main module are ignored when building the main module. It means such replace usage in dependency's go.mod cannot be inherited when building main module. And it turns out that sillygod/cdp-cache indirectly relies on manifoldco/promptui@v8.0.0, which is different from the pinned version caddyserver/caddy needed.

https://github.com/sillygod/cdp-cache/blob/master/go.mod(Line 77)

github.com/manifoldco/promptui v0.8.0 // indirect

https://github.com/caddyserver/caddy/blob/v2.4.6/go.mod(line 39)

// avoid license conflict from juju/ansiterm until https://github.com/manifoldco/promptui/pull/181
// is merged or other dependency in path currently in violation fixes compliance
replace github.com/manifoldco/promptui => github.com/nguyer/promptui v0.8.1-0.20210517132806-70ccd4709797

It doesn't necessarily cause dependency issues. So this is just a reminder in the hope that you can notice such an inconsistency.

Solution

1. Bump the version of dependency github.com/caddyserver/caddy

You can upgrade github.com/caddyserver/caddy to a new release which has eliminated the use of the replace directive.

2. Add the same replace rule to your go.mod

replace github.com/manifoldco/promptui => github.com/nguyer/promptui v0.8.1-0.20210517132806-70ccd4709797

Tips: Introduce replace directive may break go install and it can not be inherited by downstream projects.