gomod major update checksum failure

[rarkins]

What Renovate type, platform and version are you using?

Hosted app

Describe the bug

A major update fails to update the checksum

Relevant debug logs

In the PR

Click me to see logs

Copy/paste any log here, between the starting and ending backticks

Have you created a minimal reproduction repository?

Please read the minimal reproductions documentation to learn how to make a good minimal reproduction repository.

• I have provided a minimal reproduction repository: old - Update module github.com/google/go-github/v34 to v35 xoxys/test#6
• I don't have time for that, but it happens in a public repository I have linked to
• I don't have time for that, and cannot share my private repository
• The nature of this bug means it's impossible to reproduce publicly

Additional context

Reported by @xoxys in #9713

[github-actions]

Thank you for providing a reproduction! 🎉 🚀

The Renovate team will take a look at the reproduction repository. Once we confirm the provided repository reproduces the problem, the label will be changed to reproduction:confirmed.

[rarkins]

I could reproduce this locally when Renovate ran go 1.15.1, and then it was fixed when Renovate ran go 1.16.3: https://github.com/renovate-tests/test-1/pull/1/files

I'll submit a PR today so that Renovate always runs the latest go version and not the minimum which satisfies the project, because it seems bugs are not aggressively backported.

[xoxys]

But what about breaking changed in the latest go version related to module naming/update/include logic? Wouldn't it cause issues if the project is intended to work with go 1.15 and 1.16 introduces changes related to modules?

[HonkingGoose]

But what about breaking changed in the latest go version related to module naming/update/include logic? Wouldn't it cause issues if the project is intended to work with go 1.15 and 1.16 introduces changes related to modules?

Copy/paste part of the discussion that happened on #9748 between @rarkins and @bcmills

Would it be safe for us to treat go 1.15 as >= 1.15 instead and therefore pick the latest (in this case go 1.16)?

Yes. In general only the latest two major Go releases (1.16 and 1.15 today) receive bug-fixes, and even then only if the bugs are severe. We try to preserve compatibility between Go versions, so (for example) the Go 1.16 release of cmd/go knows how to interpret go.mod files that specify go 1.15.

(It should always be ok to use a newer go command to edit an older module; if you find that is not the case, please do file a bug so we can fix it. 🙂)

[rarkins]

Let's try this approach. I will add docs for how to force an older version using config and we may have to roll back this behavior change if it causes too many problems, but for now I think it will fix a lot of things.

[renovate-release]

🎉 This issue has been resolved in version 24.119.14 🎉

The release is available on:

• GitHub release
• 24.119.14

Your semantic-release bot 📦🚀

[v-byte-cpu]

I still have the same problem v-byte-cpu/sx#67

[xoxys]

Looks like just the backport PR was merged, but the merge to the main branch is still missing.

[viceice]

Enabled automerge, should be done in ~15min 🤗

[renovate-release]

🎉 This issue has been resolved in version 25.7.2 🎉

The release is available on:

• GitHub release
• 25.7.2

Your semantic-release bot 📦🚀

[xoxys]

@viceice @rarkins While this should be fixed in 24.119.14 the PR in the test repo is still not working with this renovate version :( xoxys/test#6

[xoxys]

And to make it even worse, now non-major version updates seem to be broken as well (but were working before):
thegeeklab/drone-github-comment#37

DEBUG: Go lookup source url
{
  "goModule": "golang.org/x/oauth2",
  "goSourceUrl": "https://github.com/golang/oauth2/"
}
DEBUG: Found no results from datasource that look like a version (golang.org/x/oauth2)(dependency="golang.org/x/oauth2")
{
  "result": {
    "sourceUrl": "https://github.com/golang/oauth2",
    "releases": []
  }
}

Maybe that's the wrong part from the log, but I could not find anything else that indicates and error... There is no error in the PR anymore, so it fails "silently" somehow.

[rarkins]

Please create a new issue and locate the logs for when the commit was made. Within that locate the "docker run" command and log output.

[xoxys]

Related to #9748

[clok]

When with the v25 release of renovate be available via the GitHub application? It is currently reporting v24 as the version and my go projects are no longer patching due to failure to update modules hosted via gopkg.io. It has been reported that v25 resolves this issue.

[rarkins]

Both v24 and v25 have the same capabilities here and should both now be selecting 1.16 to run. I think what is still needed is to add the gomodrw flag so that the cache is not written as read-only. However I still have some suspicions that gopkg.in caching is particularly buggy in go - it's not impacting other sources.

[clok]

Appreciate the response @rarkins. Is an active thread somewhere with regards to setting the -gomodrw flag?

[rarkins]

I got the option name wrong but it's in #9748