mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-26 07:20:39 +00:00
Jamie Tanna
9ecbaa8581
When Go updates dependencies using i.e. `go get` or `go mod download`, it uses Minimal Version Selection (MVS)[0], which takes the lowest version available from the given packages. In the case of an updated dependency, in practice this means that Go will chose the version of an indirect (transitive) package dependency as the version that the updated package points to in their `go.mod`, which must be older than the updated package, as the updated package has only just been updated. This protects against cases in other ecosystems where an unpinned transitive dependency can be pulled by an updated package, potentially bypassing `minimumReleaseAge`. However, I can imagine there may be some questions about this, so we can preemptively add a note into the `Artifact update notice` when `minimumReleaseAge` is set. [0]: https://go.dev/ref/mod#minimal-version-selection