golang模块无法将单个依赖项更新到我的.mod文件

Question

I want to update a single dependency in my modules repo.

I've looked through lots of documentation and the JustForFunc videos and it seems like the way to do this is go into the .mod file and update from "1.0.0" to "1.2.0" and run go build.

This works, but then I see my entire go.mod file changed in many places, including those that are not indirects. Some of these changed versions are major version changes for dependencies used in other places in my project. My obvious fear is this will cause a breaking change when I want these versions to remain the same.

I'm using modules and working outside my GOPATH if that matters.

Is there a way to minimize my .mod file changes?

Answer 1

tl;dr pass -mod=readonly to go commands to prevent it from automatically updating dependencies to the latest minor/patch releases.

Per the Go wiki:

To upgrade or downgrade to a more specific version, 'go get' allows version selection to be overridden by adding an @version suffix or "module query" to the package argument, such as go get github.com/gorilla/mux@v1.6.2, go get foo@e3702bed2, or go get foo@'

And from the same wiki:

The go tooling provides a fair amount of flexibility to adjust or disable these default behaviors, including via -mod=readonly, -mod=vendor, GOFLAGS, GOPROXY=off, GOPROXY=file:///filesystem/path, go mod vendor, and go mod download.

The details on these options are spread throughout the official documentation. One community attempt at a consolidated overview of knobs related to these behaviors is here, which includes links to the official documentation for more information.