go 1.17+ depth require v2.0.0 in submodule

[RelicOfTesla]

// thrid module, can not edit code
base.project     
   import  "github.com/gomodule/redigo/redis"

#cat base.project/go.mod 
go 1.14
require  github.com/gomodule/redigo v2.0.0+incompatible

test.project
   import "base.project"

#cat test.project/go.mod
go 1.17
require github.com/gomodule/redigo v1.8.8+incompatible // indirect

cd test.project
go mod tidy
cat go.mod
....
go 1.17
require  github.com/gomodule/redigo v2.0.0+incompatible // indirect
....

Is auto change to invalid version!!

Maby change old tag v2.0.0 to bakV2.0.0 ??
Or change v.1.8.8 => v3 ?

[stevenh]

v2.0.0+incompatible was revoked by v1.8.8 as its not maintained and should not be used.

Any third party modules using redigo should be v1.x series.

[ping-localhost]

I'm having a slightly different issue than @RelicOfTesla, as I have no third party dependencies that need redigo, only internal, and no matter what I do, Golang 1.17.5 always updates to v2.0.0+incompatible.

---

When using @latest v2.0.0 will always be used, because of semver. Please resolve this by removing/renaming the tag or tagging v1.8.8 as v3.

[stevenh]

@latest shouldn't use v2.0.0 as its been retracted. We can't remove the v2.0.0 as that would break those that do want it.

Could you check what the following reports:

go version go1.17 linux/amd64
go list -m -versions github.com/gomodule/redigo

[stevenh]

Just tested here in a new pkg to see what happened and it did pickup 1.8.8

$ go mod init test.com/wibble
go: creating new go.mod: module test.com/wibble
go: to add module requirements and sums:
       go mod tidy
$ go mod tidy
go: finding module for package github.com/gomodule/redigo/redis
go: found github.com/gomodule/redigo/redis in github.com/gomodule/redigo v1.8.8
$ more go.mod
module test.com/wibble

go 1.17

require github.com/gomodule/redigo v1.8.8

[ping-localhost]

Confirmed. Not sure what's happening in my other project then, but I guess it's an unrelated issue. My apologies for wasting your time.

[stevenh]

No problem glad you're all sorted @ping-localhost 👍

[stevenh]

So to be clear, third party modules need to be go v1.16 and above (required for retract support), and then when updated they will pickup v1.8.8 or above.