Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: go mod tidy removes an in-use indirect dependency from go.mod #27664

Closed
zombiezen opened this issue Sep 13, 2018 · 5 comments

Comments

Projects
None yet
2 participants
@zombiezen
Copy link
Member

commented Sep 13, 2018

What version of Go are you using (go version)?

go version go1.11 linux/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/home/light/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/light"
GOPROXY=""
GORACE=""
GOROOT="/home/light/sdk/go1.11"
GOTMPDIR=""
GOTOOLDIR="/home/light/sdk/go1.11/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/light/src/github.com/google/go-cloud/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build947809198=/tmp/go-build -gno-record-gcc-switches"

It should be noted I'm running with GO111MODULE=on.

What did you do?

export GO111MODULE=on
git clone https://github.com/google/go-cloud.git
cd go-cloud
git checkout 64759c9ac3d4068c1e322814b088ba08a8ee360f
go mod tidy

What did you expect to see?

go mod tidy keeps gopkg.in/yaml.v2, an indirect dependency.

What did you see instead?

go mod tidy removes gopkg.in/yaml.v2 from go.mod, but not from go.sum.

Intriguingly, running go mod why gopkg.in/yaml.v2 yields:

# gopkg.in/yaml.v2
github.com/google/go-cloud/internal/testing/replay
github.com/dnaeon/go-vcr/cassette
gopkg.in/yaml.v2

/cc @bcmills

@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 13, 2018

Do the other dependencies in the go.mod file imply any version of gopkg.in/yaml.v2?

@bcmills bcmills added this to the Go1.12 milestone Sep 13, 2018

@zombiezen

This comment has been minimized.

Copy link
Member Author

commented Sep 13, 2018

github.com/dnaeon/go-vcr seems to, as it includes Gopkg.{lock,toml}. But it was my understanding/expectation that go mod tidy should include all indirect dependencies now, regardless of whether they could be inferred from other dependencies. (I forget where I gained this notion.)

@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 13, 2018

No, go mod tidy includes

  • all of the direct dependencies, plus
  • the subset of indirect dependencies that have been upgraded past their otherwise-implied versions.
@bcmills

This comment has been minimized.

Copy link
Member

commented Sep 14, 2018

I think this is working as designed, but please reopen if you disagree.

@bcmills bcmills closed this Sep 14, 2018

@zombiezen

This comment has been minimized.

Copy link
Member Author

commented Sep 14, 2018

Very possibly. I could have sworn @rsc said that a go.mod file after go mod tidy would reflect all the dependencies (so you wouldn't have to run go list etc.), but I can't find a citation now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.