cmd/go: go list -m -versions shows a retracted version

[hajimehoshi]

What version of Go are you using (go version)?

$ go version
go version go1.18 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/hajimehoshi/Library/Caches/go-build"
GOENV="/Users/hajimehoshi/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/hajimehoshi/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/hajimehoshi/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.18"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/60/khbk2xqn1c5bml1byjn89dwc0000gn/T/go-build949567127=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

go list -m -versions github.com/hajimehoshi/oto/v2

The go.mod retracts v2.3.0-alpha.4: https://github.com/hajimehoshi/oto/blob/21593abf964d5174d9968759dcfee3172053d836/go.mod

module github.com/hajimehoshi/oto/v2

go 1.16

require golang.org/x/sys v0.0.0-20220712014510-0a85c31ab51e

retract v2.3.0-alpha.4 // Wrongly tagged

What did you expect to see?

github.com/hajimehoshi/oto/v2 v2.0.0-alpha v2.0.0-alpha.1 v2.0.0-alpha.2 v2.0.0-rc.1 v2.0.0 v2.0.1 v2.0.2 v2.0.3 v2.1.0-alpha v2.1.0-alpha.1 v2.1.0-alpha.2 v2.1.0-alpha.3 v2.1.0-alpha.4 v2.1.0-alpha.5 v2.1.0-alpha.6 v2.1.0-alpha.7 v2.1.0-alpha.8 v2.1.0-alpha.9 v2.1.0-rc.1 v2.1.0 v2.2.0-alpha v2.2.0-alpha.1 v2.2.0-alpha.2 v2.2.0-alpha.3 v2.2.0-alpha.4 v2.2.0-alpha.5 v2.2.0-alpha.6

What did you see instead?

github.com/hajimehoshi/oto/v2 v2.0.0-alpha v2.0.0-alpha.1 v2.0.0-alpha.2 v2.0.0-rc.1 v2.0.0 v2.0.1 v2.0.2 v2.0.3 v2.1.0-alpha v2.1.0-alpha.1 v2.1.0-alpha.2 v2.1.0-alpha.3 v2.1.0-alpha.4 v2.1.0-alpha.5 v2.1.0-alpha.6 v2.1.0-alpha.7 v2.1.0-alpha.8 v2.1.0-alpha.9 v2.1.0-rc.1 v2.1.0 v2.2.0-alpha v2.2.0-alpha.1 v2.2.0-alpha.2 v2.2.0-alpha.3 v2.2.0-alpha.4 v2.2.0-alpha.5 v2.2.0-alpha.6 v2.3.0-alpha.4

So v2.3.0-alpha.4 is included. I'm not sure whether this is expected or not. If this is expected, is there a way to deprecated the tagged version v2.3.0-alpha.4?

[hajimehoshi]

Another issue is that go get -u all at a project using Oto tries to get v2.3.0-alpha.4. How can I prevent this?

[hajimehoshi]

https://go.dev/ref/mod#go-mod-file-retract

To retract a version, a module author should add a retract directive to go.mod, then publish a new version containing that directive. The new version must be higher than other release or pre-release versions; that is, the @latest version query should resolve to the new version before retractions are considered. The go command loads and applies retractions from the version shown by go list -m -retracted $modpath@latest (where $modpath is the module path).

Ah, this seems expected...