go mod vendors older version of dependency

Question

I upgraded to go1.11 and i am trying to use go modules. I cloned a project and ran go build which creates a go.mod and go.sum files with all my dependencies.

Now i would like to vendor the files so i run the command go mod vendor

Unfortunately go mod vendors an older version of go-bindata . My project is unable to build because a function call does not exist. Looking at the source code of the vendored go-bindata i can see that it is different from what is available in the master branch of go-bindata project.

In my go.mod file there's this:

github.com/jteeuwen/go-bindata v3.0.7+incompatible

In my go.sum file, there's this:

github.com/jteeuwen/go-bindata v3.0.7+incompatible h1:91Uy4d9SYVr1kyTJ15wJsog+esAZZl7JmEfTkwmhJts=
github.com/jteeuwen/go-bindata v3.0.7+incompatible/go.mod h1:JVvhzYOiGBnFSYRyV00iY8q7/0PThjIYav1p9h5dmKs=

On GitHub, the most recent tag for go-bindata is v3.0.7 on the master branch.

Any ideas why go mod references an older version and how can i fix that. On a different machine, running go get -u https://github.com/jteeuwen/go-bindata gets the most up to date project. Why does go mod not do the same?

EDIT: The problem is that go mod says it got v3.0.7 but the source code doesn't match what is currently available on Github with the 3.0.7 tag. What i have locally looks like v3.0.6 but is tagged as v3.0.7.

In the version on Github, there is a struct that looks like this: link to source

type Config struct {
     //... some other fields
     NoMetadata bool
}

But in my local vendored version, the Config struct doesn't have NoMetadata field. It looks like go mod is using an older tag and thinks it's using the most recent.

Answer 1

The most recent tag for that repo is v3.0.7, so that's what go mod gets you. From the FAQ :

If a repository has not opted in to modules but has been tagged with valid semver tags (including the required leading v), then those semver tags can be used in a go get, and a corresponding semver version will be record in the importing module's go.mod file.

Is the issue that you want code that's not in the 3.0.7 tag, but is in the master branch?

---

Looking at the specific NoMetadata field in your update, it was added in https://github.com/jteeuwen/go-bindata/commit/7f4fb1184ff6bab28016ed674b61864665ba3d97 , on 2015-08-13. Meanwhile, v3.0.7 was tagged on 2014-11-20

So it seems like the changes you're interested in are not tagged and are only on the master branch.

Given this situation you could just fork the repository - it hasn't been maintained since 2015 (and the README acknowledges it's unmaintainted). Or find something that's being kept up-to-date. Or convince the maintainers to create a new tag.

Answer 2

This is a bug of go I guess. Use hash code of commit in go.mod file to get exact version of branch.

When you run go mod vendor hash code in go.mod will be replaced with correct version and vendor directory will have necessary code.

before:

replace github.com/example-project/example-app/go/v3 => github.com/example-project/example-app/go/v3 952d4033cffcf7ed10de054f6f80547bcd9b45f9

after:

replace github.com/example-project/example-app/go/v3 => github.com/example-project/example-app/go/v3 v3.8.2-0.20210812190102-1f3470d253d3