deps: bumps all golang deps #87
Conversation
bumping all golang deps to close a few dependabots issues
| @@ -1,30 +1,31 @@ | |||
| module github.com/rmohr/bazeldnf | |||
|
|
|||
| go 1.19 | |||
| go 1.22.0 | |||
There was a problem hiding this comment.
Do we want to use 1.21.x? It's still a supported release.
There was a problem hiding this comment.
Actually, nix that. 1.22 is probably fine as the release of 1.24.x is imminent. However, do we want to use 1.22.10 here as there's a bunch of security fixes and such?
There was a problem hiding this comment.
Do we want to use 1.21.x? It's still a supported release.
When we run go through bazel we get:
$ bazel run @rules_go//go -- env 2>/dev/null | grep GOVERSION
GOVERSION='go1.22.7'
Don't forget that go is managed by rules_go and not provided by the host
Actually, nix that. 1.22 is probably fine as the release of 1.24.x is imminent. However, do we want to use 1.22.10 here as there's a bunch of security fixes and such?
Sure but you would still pin to 1.22.0 in the go.mod, that's what we get when we do a go mod tidy with a newer go, the minor does not matter at all.
We manage go.mod with the same go version as it points to the right go.mod
bazel run @rules_go//go -- env 2>/dev/null | grep GOMOD=
GOMOD='<workspace>/go.mod'
I'll merge this change then
bumping all golang deps to close a few dependabots issues