Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposal: cmd/go: enable listing direct dependency updates #40364

Open
icholy opened this issue Jul 23, 2020 · 3 comments
Open

proposal: cmd/go: enable listing direct dependency updates #40364

icholy opened this issue Jul 23, 2020 · 3 comments
Labels
Projects
Milestone

Comments

@icholy
Copy link

@icholy icholy commented Jul 23, 2020

Intro

The recommended approach to listing available module updates is to run the following command.

go list -u -m all

This displays every dependency along with newer available versions.

go list -u -m all
github.com/icholy/utm
github.com/google/go-cmp v0.5.0 [v0.5.1]
github.com/pkg/errors v0.8.1 [v0.9.1]
github.com/spf13/pflag v1.0.3 [v1.0.5]
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 [v0.0.0-20200709230013-948cd5f35899]
golang.org/x/net v0.0.0-20190311183353-d8887717615a [v0.0.0-20200707034311-ab3426394381]
golang.org/x/sync v0.0.0-20190423024810-112230192c58 [v0.0.0-20200625203802-6e8e738ad208]
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a [v0.0.0-20200722175500-76b94024e4b6]
golang.org/x/text v0.3.0 [v0.3.3]
golang.org/x/tools v0.0.0-20190624222133-a101b041ded4 [v0.0.0-20200723000907-a7c6fd066f6d]
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543
gotest.tools/v3 v3.0.2

My go.mod only specifies two dependencies.

  
module github.com/icholy/utm

go 1.14

require (
	github.com/google/go-cmp v0.5.0
	gotest.tools/v3 v3.0.2
)

Problem

The go list output gets completely unmanageable when the dependency tree grows. When listing available module updates, I'm only interested in my direct dependencies. Those are the only ones I usually have control over.

The go list command has a -json flag which makes it possible to feed into external tools such as https://github.com/psampaz/go-mod-outdated. However, I find it strange that I need external tooling to ask "which modules in go.mod are outdated"

Proposal

I propose a mechanism for limiting the go list output to direct dependencies.

go list -u -m direct

Relates to #40323

@gopherbot gopherbot added this to the Proposal milestone Jul 23, 2020
@gopherbot gopherbot added the Proposal label Jul 23, 2020
@mvdan
Copy link
Member

@mvdan mvdan commented Jul 23, 2020

We've discussed this multiple times before with the tooling/modules folks, mostly on Slack and on the golang-tools monthly calls. The only written down notes I could find right now are #27887 (comment); @bcmills @rogpeppe @jayconrod @myitcv might have more links.

@icholy
Copy link
Author

@icholy icholy commented Jul 23, 2020

The provided solution uses go lists template ability to filter out indirect dependencies.

go list -f '{{if not .Indirect}}{{.}}{{end}}' -u -m all

I don't think it's reasonable to expect users to type this out every time. A bash alias can be created, but that's not portable and has the same problems as using an external tool (you have to know about it, and set it up).

The common use-case for people developing module tooling is not the same as for people consuming the module tooling. I think that most people just want to know if they have any dependencies to go get -u. Usually in Go, simple thing are simple to do, but complex things are still possible. go list only gives us that second half.

edit: I suppose what I actually want is a veneer on top of go list (ex: go mod updates).

@icholy icholy changed the title Proposal: cmd/go Enable only listing direct dependencies Proposal: cmd/go Enable only listing direct dependency updates Jul 23, 2020
@icholy icholy changed the title Proposal: cmd/go Enable only listing direct dependency updates Proposal: cmd/go Enable listing direct dependency updates Jul 23, 2020
@jayconrod jayconrod changed the title Proposal: cmd/go Enable listing direct dependency updates proposal: cmd/go: enable listing direct dependency updates Jul 23, 2020
@jayconrod
Copy link
Contributor

@jayconrod jayconrod commented Jul 23, 2020

I think this would be good to have. It's pretty common to want to list or upgrade direct dependencies of packages in the main module. It's too hard to do that with go list right now. Some thoughts though:

  • go get -d direct should work, too, not just go list -m -u direct.
  • We need a clear definition of direct. When lazy loading is implemented (#36460), the set of modules required in go.mod will expand, so I don't think it would make sense to define direct module dependencies as those required in go.mod. Even today, there may be // indirect requirements, and those dependencies may not be listed anywhere else. Maybe it should be defined at the package level as "the set of packages directly imported by packages in the main module".
@ianlancetaylor ianlancetaylor added this to Incoming in Proposals Aug 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Proposals
Incoming
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
You can’t perform that action at this time.