https://github.com/dop251/modtools

Keep your go.mod dependencies up-to-date
https://github.com/dop251/modtools

Last synced: about 1 month ago
JSON representation

Keep your go.mod dependencies up-to-date

• Host: GitHub
• URL: https://github.com/dop251/modtools
• Owner: dop251
• License: mit
• Created: 2021-03-21T18:29:34.000Z (almost 4 years ago)
• Default Branch: master
• Last Pushed: 2022-03-14T12:06:35.000Z (almost 3 years ago)
• Last Synced: 2024-10-14T21:48:44.479Z (2 months ago)
• Language: Go
• Size: 25.4 KB
• Stars: 2
• Watchers: 2
• Forks: 2
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
modtools - Keep your go.mod dependencies up-to-date.

====

modtools is a command-line toolset designed to help keeping the go.mod dependencies up-to-date while still allowing exceptions.

Why?

---

Dependency pinning has its obvious advantages: for a project with dozens of dependencies you don't want your

build to break unpredictably due to a change in one of them. The flip side is that dependencies tend to become

stale. The changes within the same major version should maintain compatibility and in most cases they don't actually

break anything, but instead provide new features, bugfixes and security updates. That's why upgrading should be

done on a regular basis.

Modtools is designed to make the process of upgrading dependencies easier. Running `modtools check` shows the list

of direct and indirect dependencies that can be upgraded. It prints the list of commands that need to be run and

exits with a non-zero code if such dependencies exist:

```console

$ go install github.com/dop251/modtools@latest

$ modtools check

Some dependencies are out-of-date. Please upgrade by running 'modtools update' or the following commands:

go get github.com/kr/[email protected]

go get github.com/kr/[email protected]

go get gopkg.in/[email protected]

Error: check has failed

```

This command could be added to a CI pipeline running on a schedule or to a commit hook.

In case a new version of a dependency causes a problem it can be added to the exception list by running

`modtools freeze modpath` so that it's ignored for up to the specified number of days:

```console

$ modtools freeze gopkg.in/check.v1 14

Don't forget to add modtools_frozen.yml to the repository.

```

During this time the necessary adjustments need to be made to accommodate for the change (if it was deliberate),

or a bug report should be raised if it wasn't. When the problem is fixed

`modtools thaw modpath` can be used to remove `modpath` from the list of exceptions.