Hacker News Reader

Comment by preseinger | Hacker News Reader

The newest from go.sum isn't reliably the version used in the dep graph. The only way to get that information reliably is via go list. Unfortunately.

Oh, you are totally right. I read that in the GitLab issue tracking their version of the problem and totally forgot that’s where they landed.

Also don't forget that more than one version of a dependency might be compiled into your application!

not true for go

Only one major version. And go considers different major versions to be different dependencies.

For the curious it's:

    go list -m all