1

Leaving aside whether this is a good idea, is there a way to structure go.mod so that the latest version of a dependency is always used?

The one way that I have discovered to do it is to, for example, have

require (
    gonum.org/v1/gonum latest
)

which downloads and resolves to the latest version of gonum when using e.g. go get. However, that also updates my go.mod file, removing the latest tag.

Should I just keep the go.mod file in my git repository as a version containing the latest tag and allow users' versions to be updated when they build etc.?

blackgreen
  • 34,072
  • 23
  • 111
  • 129
NatWH
  • 129
  • 1
  • 5
  • 2
    "Should I just keep the go.mod file in my git repository as a version containing the latest tag" -- No, this is a bad idea. It would circumvent the safety measures that go.mod provides (detailed in the answers below). Better not to fight the tools. – Jonathan Hall Jul 06 '21 at 16:17
  • You could create a CI script or git hook that ensures that _at the time of commit_, every dependency is at the latest version. This is within the spirit of the Go tools, but of course won't pull in future versions until you do another update. – Jonathan Hall Jul 06 '21 at 16:20

2 Answers2

7

There's no way to do this automatically in go.mod. That's by design actually: go.mod is intended to let the go command select a set of versions deterministically with any build. If the go command always picked the latest version of a dependency, the set of selected versions would change over time without any user action. If one of your dependencies always picked the latest version of one its dependencies, that could break your build, and it would be difficult to override.

go get example.com/mod is the best way to stay up to date. That needs to be done manually, but you can automate it with a script or an action in CI if you have a large number of dependencies.

Jay Conrod
  • 28,943
  • 19
  • 98
  • 110
5

Just run go get <module>.

go get downloads the latest version of a dependency because that's what it does, not because you specified latest in go.mod.

is there a way to structure go.mod so that the latest version of a dependency is always used?

No, you are not supposed to manually edit the content of go.mod require directive yourself anyway. Moreover, the syntax of require directives is defined as:

require module-path module-version

where module-version can be an actual tagged version or a pseudo-version, e.g. when you require a specific commit.

Technically you can write latest in a require directive, but the next time you run a go command, it will replace the word latest with the actual latest (pseudo-)version tag. It will not stay latest, otherwise you wouldn't have deterministic dependencies.

Related: How to point Go module dependency in go.mod to a latest commit in a repo?

blackgreen
  • 34,072
  • 23
  • 111
  • 129