Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support using a later patch release than what's in go.mod #481

Open
perj opened this issue May 29, 2024 · 1 comment
Open

Support using a later patch release than what's in go.mod #481

perj opened this issue May 29, 2024 · 1 comment
Labels
feature request New feature or request to improve the current logic

Comments

@perj
Copy link

perj commented May 29, 2024

Description:
Some packages (e.g. k8s.io/apimachinery) puts go 1.22.0 in their go.mod file. This propogates to applications using it, which also gets go 1.22.0 in go.mod. Setup-go will then find that exact version. I would like a flag, possibly enabled by default, to instead use the latest patch version, as long as it's greater than the one in go.mod.

Justification:
Using 1.22.0 could be a security risk. Before our go.mod was changed to say go1.22.0, setup-go was using 1.22.3, now it's downgraded. We can solve this by manually setting go1.22.3, but we can't set go1.22 since that's considered lower than 1.22.0, so there's no way to say "use latest version" via go.mod right now.

Are you willing to submit a PR?
Yes, possibly, but it will probably take me a while to make it a priority.

@perj perj added feature request New feature or request to improve the current logic needs triage labels May 29, 2024
@HarithaVattikuti
Copy link
Contributor

Hello @perj
We appreciate your suggestion for a new feature! We'll make sure to address it when we have the opportunity.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature request New feature or request to improve the current logic
Projects
None yet
Development

No branches or pull requests

2 participants