build(deps): set go.mod to 1.24 and retract v2.1.4 #37
Conversation
pkazmierczak
changed the title
.go-version
Outdated
| @@ -1 +1 @@ | |||
| 1.25.1 | |||
| 1.24.0 | |||
There was a problem hiding this comment.
Should we be using the oldest 1.24 or the current 1.24 here?
There was a problem hiding this comment.
These need to match either the go directive or the toolchain directive in the mod file. Otherwise linter will protest that we need to tidy.
There was a problem hiding this comment.
all this is to say: we should be setting go in go.mod and .go-version here to the same exact version. Or have a toolchain directive in the mod file.
There was a problem hiding this comment.
What I'm concerned about here is that there's going to be a CVE in Go and someone is going to end up rev'ing the minimum version again instead of fixing the toolchain itself. So while I think the linter is frankly just wrong, if we need to set a toolchain directive to shut it up, that seems fine to me.
2 participants
This PR sets Go mod version for the package to 1.24 and retracts package v2.1.4 which set an unnecessarily high requirement for Go to be 1.25.1.