Jamie Tanna
aae889a285
* fix(datasource/go): cache the publication time of each version The Go proxy defines that the `.info` API call is for a specific release version of a module, this file should never be modified after it's been created. However, because we previously had a 30m TTL on these entries, a repository that runs infrequently can lead to re-fetching data that doesn't ever update. We can fix this by introducing a separate cache namespace for the module's creation timestamp (`Time` in the `.info` API call). We can make sure that: - we always merge, not replace, the entries, as the `major < 2` filter in `_getReleases` means a run may only see a subset of a module's versions, and writing back only what we saw would evict the rest - we re-read immediately before writing, as `foo` and `foo/v2` are separate lookups which both walk the `v2` module, so one can overwrite the other's timestamps - the key is the proxy which served the data, minus any credentials, since a private Artifactory `GOPROXY` is a different universe of timestamps to `proxy.golang.org` - only the timestamps we successfully fetched are stored, so a proxy which serves no `Time` doesn't have that recorded for 100 days - it uses its own namespace, so that a `cacheTtlOverride` on the release cache doesn't drag the immutable data down with it Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io> * fixup! fix(datasource/go): cache the publication time of each version Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io> * fixup! fixup! fix(datasource/go): cache the publication time of each version Co-Authored-By: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io> --------- Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
The best way to lookup Go Modules is using Go proxies.
GOPROXY settings
This datasource will use default GOPROXY settings of https://proxy.golang.org,direct if the environment variable is unset.
To override this default and use a different proxy in self-hosted environments, configure GOPROXY to an alternative setting in env.
To override this default and stop using any proxy at all, set GOPROXY to the value direct.
Pseudo versions
Go proxies return an empty list of versions when queried (@v/list) for a package which uses pseudo versions, but return the latest pseudo-version when queried for @latest.
If the @latest endpoint returns a pseudo-version, and the release list is empty, then this datasource will return the latest pseudo-version as the only release/version for the package.
Checking for new major releases
When a Go proxy is queried for @v/list it returns only versions for v0 or v1 of a package.
Therefore Renovate will also query @v2/list just in case there also exists a v2 of the package.
Similarly, if the dependency is already on a higher version such as v5, Renovate will check in case higher major versions exist.
You do not need to be worried about any 403/404 responses which result from such checks - they are the only way for Renovate to know if newer major releases exist.
Release timestamps
A Go proxy reports the commit time of the tagged commit as a version's Time, which can be different to when the release first existed.
This inconsistency can lead to minimumReleaseAge being applied incorrectly to the Go module's updates.
!!! note
For modules hosted on GitHub, Renovate will look up if there is a GitHub Release on the repository, and if so, use the Release's publication time, if it's later than the timestamp reported by the Go proxy.
This lookup needs a GitHub token to be configured, and is skipped if the lookup fails, leaving the timestamp reported by the Go proxy in place.
For example, this happens when:
- an infrequently updated repository prepares a GitHub Release by creating a draft release
- some time passes, and the maintainers publish the Release
- no new commits are pushed to the release branch (i.e.
main) in that time
Fallback to direct lookups
If no result is found from Go proxy lookups then Renovate will fall back to direct lookups.