logoalt Hacker News

ncruceslast Thursday at 7:25 AM1 replyview on HN

> No, it does not. Minimum version selection means that the libraries will at least be that version, but it could be substituted for a later version if a transient dependency asks for such.

No?

All dependencies - direct and indirect - are listed in your go.mod. Your module - as is - depends on nothing else. And those exact versions will be used to build it, if yours is the main module.

If your module is used as a dependency of another module, then yes, your module may be built with a newer version of those dependencies. But that version will be listed in that module's go.mod.

There's no way to use different versions without them being listed in some go.mod.

go.sum to only maps between versions and hashes, and may contain hashes for multiple versions of modules.


Replies

skywhopperlast Thursday at 11:45 AM

But a “version” as listed in go.mod may have different hashes over time, if tags are changed. That’s the issue.

show 2 replies