3 ms·
go.mod IS a lockfile. go.mod will exactly tell you what version you have, always. * * that does not apply if your code is a library; then, other dependency of
by shp0ngle 4y ago
go.mod IS a lockfile.
go.mod will exactly tell you what version you have, always. *
* that does not apply if your code is a library; then, other dependency of the "main" app can "update" your dependency. Which sometimes does break things.
However, the go.mod of the main app will deterministically tell what version is used, always.
I never did understand what packages go to go.sum though and what is the logic there. But it is not that important.
- preseinger 4y agoThis is only true for go 1.17 and above. Prior to that, go.mod wouldn't necessarily list all transitive dependencies. And I don't think this property is actually guaranteed by the relevant specification. The only reliable way to get a "lock file" is to run go list. Unfortunately.
- indil 4y agogo.mod lists minimum versions. Minimum Version Selection may increase the versions used as required by other packages in the build. go.mod isn't a lock file.