the github.com/Nerzal/gocloak repo has v2.0.0 tag, but the go build/test always override the version in go.mod file to v0.0.0-20190525151100-dfd1e50572f8

If you do not wish to for your go.mod to be updated, you can do a build using the -mod=readonly flag, i.e.:

go build -mod=readonly .

You can also use vendored deps, by using the vendor mod flag:

go build -mod=vendor .

Thanks, but why the versions of other packages are not changed? Build changes only the line with gocloak.

require (
	github.com/DATA-DOG/godog v0.7.13
	github.com/Nerzal/gocloak v0.0.0-20190525151100-dfd1e50572f8
	github.com/dgrijalva/jwt-go v3.2.0+incompatible
	github.com/golang/mock v1.3.1
	github.com/golang/protobuf v1.3.1
	github.com/google/uuid v1.1.1
	github.com/grpc-ecosystem/go-grpc-middleware v1.0.0
	github.com/inconshreveable/mousetrap v1.0.0 // indirect
	github.com/mattn/go-runewidth v0.0.4 // indirect
	github.com/mitchellh/go-homedir v1.1.0
	github.com/olekukonko/tablewriter v0.0.1
	github.com/spf13/cobra v0.0.3
	github.com/spf13/pflag v1.0.3
	github.com/spf13/viper v1.3.2
	golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f
	golang.org/x/lint v0.0.0-20190409202823-959b441ac422 // indirect
	golang.org/x/net v0.0.0-20190522155817-f3200d17e092
	golang.org/x/sys v0.0.0-20190529130038-5219a1e1c5f8 // indirect
	golang.org/x/text v0.3.2 // indirect
	golang.org/x/tools v0.0.0-20190529010454-aa71c3f32488 // indirect
	google.golang.org/grpc v1.20.1
	gopkg.in/resty.v1 v1.12.0
	gopkg.in/yaml.v2 v2.2.2
)

On possible reason could be because you have gocloak set to v2 in go.mod and your import statement does not have a v2 suffix then go build assumes uses the latest commit that is a <2 version and updates the go.mod to point to that commit and version, one solution would be to change your imports from:

import "github.com/Nerzal/gocloak"

to

import "github.com/Nerzal/gocloak/v2"

This is documented here:

• Go Modules - Semantic Import Versioning

build iam/pkg/cmd/iam_api: cannot load github.com/Nerzal/gocloak/v2: cannot find module providing package github.com/Nerzal/gocloak/v2

Why build doesn't override the github.com/DATA-DOG/godog v0.7.13or github.com/dgrijalva/jwt-go v3.2.0+incompatible lines? We import these packages without v0 or v3 suffixes

Update your go.mod file package to also have v2 suffix, when the package version is below 2 then package suffixes are not needed, i.e., in go.mod:

require github.com/Nerzal/gocloak/v2 v2.0.0

May I recommend opening a help topic in the golang forums?, it seems like this is not an issue with the go project.

I'll follow up there when time permitting, the forums can be located here:

• https://forum.golangbridge.org/

I think the reason this is happening is because github.com/Nerzal/gocloak is a v2 module, but is missing the required /v2 at the end of its module statement in its go.mod:

https://github.com/Nerzal/gocloak/blob/v2.0.1/go.mod#L1

I'd suggest opening an issue on that repository.

#31543 and other issues cover making this a bit clearer. (See "Factor 2" section in #31543 for a bit more).

CC @tbpg @jayconrod @bcmills

Why build doesn't override the github.com/DATA-DOG/godog v0.7.13or github.com/dgrijalva/jwt-go v3.2.0+incompatible lines? We import these packages without v0 or v3 suffixes

v0 and v1 packages do not require the major version suffix to import/use them. However, once you get beyond v2, you have to include the major version.

This is a new requirement, so in order to facilitate backwards compatibility with repos that already had v2+ tags, Go supports +incompatible on the version. This makes it so you can use a v2+ tag even if the repository doesn't follow semantic import versioning. Once you create a module for the repo, it should follow the semantic import versioning (SIV) rule, or you end up with the pseudo-version you see in this issue.

The gocloak repo is not following this rule right now. Go should make it easier to understand, find, and prevent this error, as @thepudds pointed out.

I think we can close this issue in favor of #31543.

Guys, thank you so much for the help, it's little bit unclear