Vulnerabilities due to old go version

[imvtsl]

Vulnerabilities due to old go version

[marktheunissen]

Makes sense. I am using go 1.21.1

Yes you need to upgrade :)

So go.mod only defines the minimum version of Go that's compatible with the repository. Output of govulncheck depends on the version used by the end-user.

Correct (for stdlib vulns).

When do we decide to update it?

When we use a new feature of the Go language that is only available in the latest release, e.g. the stdlib might add a function that we use. Then we need to bump this version number

[imvtsl]

Thank you for the clarifications!!

[marktheunissen]

go.mod is the minimum Go version. See https://go.dev/doc/modules/gomod-ref#go

That means that a user of minio-go who compiles it with Go 1.22 (or whatever the latest is) will not be affected by vulnerabilities in the Go standard library of an older version.

[marktheunissen]

Also FYI:

~/src/minio-go on master ❯ govulncheck -show verbose ./...
Scanning your code and 167 packages across 10 dependent modules for known vulnerabilities...

Fetching vulnerabilities from the database...

Checking the code against the vulnerabilities...

No vulnerabilities found.

~/src/minio-go on master ❯ go version
go version go1.22.4 darwin/arm64

[imvtsl]

Makes sense. I am using go 1.21.1
So go.mod only defines the minimum version of Go that's compatible with the repository. Output of govulncheck depends on the version used by the end-user.
Out of curiosity, how do we decide on the minimum Go version for this repository? When do we decide to update it?