Potential collision and risk from indirect dependence 'hashicorp/go-immutable-radix'

[HappyHacker123]

Description

hashicorp/memberlist has already opted into module and indirectly depends on hashicorp/go-immutable-radix through a GOPATH project. And project hashicorp/go-immutable-radix already opted into module and released a v2+ version with the major branch strategy. The latest module path of hashicorp/go-immutable-radix is "github.com/hashicorp/go-immutable-radix/v2" . From module-unaware project\'s perspective, it interprets the import path "github.com/hashicorp/go-immutable-radix" as hashicorp/go-immutable-radix\'s latest version. But from the Go Modules\' point of view, path "github.com/hashicorp/go-immutable-radix" equals to version v0/v1 or the latest version that doesn’t use the module. So when you try to get hashicorp/go-immutable-radix through the indirect path "github.com/hashicorp/go-immutable-radix" which comes from module-unaware project, the module pulls the old version of hashicorp/go-immutable-radix v1.0.0. While the latest version is github.com/hashicorp/go-immutable-radix/[email protected] . This causes version of hashicorp/go-immutable-radix , which you are dependent on, sticked at the old version hashicorp/go-immutable-radix.

Solution

Add a replace directive in your go.mod files with version information to avoid sticking at the old version.