You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
N.B.: I am not picking on the two chosen modules here, they just happened to be those which I was using when I noticed the problem, and I wasn't able to deduce the root cause and thus cannot reduce to a (more) minimal reproducible example.
Create a new module in an empty directory
$ go mod init example.com/indirect
Create a simple main.go using the ristretto package
Get the ristretto module and tidy the modules
$ go get email@example.com
$ go mod tidy -v
Examine the go.mod file for the presence of the go-spew module
$ go mod tidy -vunused github.com/cespare/xxhash/v2unused github.com/dgraph-io/ristrettounused github.com/dustin/go-humanizeunused github.com/golang/glogunused github.com/pkg/errorsunused golang.org/x/sys
Check yet again for the presence of go-spew module
$ grep go-spew go.mod ||echo not foundgithub.com/davecgh/go-spew v1.1.1 // indirect
Adding dynamodb before ristretto does not change the outcome
However, removing dynamodb instead of ristretto does change the outcome: go-spew is not added to go.mod
What did you expect to see?
Any of the following would have made sense:
go-spew added to go.mod by go get .../ristretto
go-spew added to go.mod by go get .../dynamodb
go-spew never added to go.mod
What did you see instead?
Instead, the go-spew module didn't show up in my go.mod until after I removed the ristretto module.
Both ristretto and dynamodb seem to require go-spew indirectly; ristretto's go.mod specifies go 1.17 and thus lists go-spew explicitly, while dynamodb's go.mod specifies only go 1.15 and doesn't list any indirect requirements.
The text was updated successfully, but these errors were encountered:
The requirement through ristretto is on v1.1.1.
The requirement through dynamodb is on v1.1.0.
Version v1.1.1 is selected, but both use it as indirect, test only dependencies, which means it can be pruned out if a requiring module go directive is high enough.
When ristretto is removed, to maintain the version requirement of v1.1.1 or higher (MVS), it needs to be added as an indirect dependency.