Dependency issue with bufbuild/protovalidate-go

[lukasbindreiter]

Hi,

Our go package has a dependency on github.com/bufbuild/buf (we are using it in a tools.go and haven't upgraded to the new go tools yet) - which means we also upgrade it from time to time with our other dependencies, most of the time using a simple go get -u ./...

For a while now however this always fails and results in a depdency conflict.

The error message looks like this:

go: finding module for package github.com/bufbuild/protovalidate-go/resolver
go: finding module for package github.com/bufbuild/protovalidate-go/celext
go: github.com/tilebox/tilebox-go imports
        github.com/bufbuild/buf/cmd/buf imports
        github.com/bufbuild/buf/private/buf/cmd/buf imports
        github.com/bufbuild/buf/private/buf/cmd/buf/command/beta/bufpluginv1 imports
        github.com/bufbuild/buf/private/bufpkg/bufcheck/bufcheckserver imports
        github.com/bufbuild/buf/private/bufpkg/bufcheck/bufcheckserver/internal/bufcheckserverbuild imports
        github.com/bufbuild/buf/private/bufpkg/bufcheck/bufcheckserver/internal/bufcheckserverhandle imports
        github.com/bufbuild/buf/private/bufpkg/bufcheck/bufcheckserver/internal/buflintvalidate imports
        github.com/bufbuild/protovalidate-go/celext: module github.com/bufbuild/protovalidate-go@latest found (v0.9.2), but does not contain package github.com/bufbuild/protovalidate-go/celext

It's related to the resolver package here: https://github.com/bufbuild/protovalidate-go being renamed to resolve. It is still used though using the old name: https://github.com/bufbuild/buf/blob/main/private/bufpkg/bufcheck/bufcheckserver/internal/buflintvalidate/buflintvalidate.go#L21

So if go tries to upgrade both bufbuild/buf and protovalidate-go to the latest version, it will fail.

Would it be possible to update the import in buflintvalidate in an upcoming release, such that auto upgrade works again? Would be greatly appreciated!

[emcfarlane]

Hello, this is being looked into in #3652 , though the method of installation is not a supported type. See the list of supported installs here.

[lukasbindreiter]

@emcfarlane

Thanks for looking into it already - sorry somehow I missed the ongoing PR, I only searched the issue list for related existing issues.

I know there are lots of ways to install it - but installing it via the go package manager has the advantage that every developer always has the same version, since it's part of go.mod then.

And since go1.24 even introduced a new feature for tools such as buf - do you have any plans on maybe adding that installation method as an official one?
e.g. https://blog.howardjohn.info/posts/go-tools-command/

[paskozdilar]

I also ran into this problem, glad to see it's already under consideration.

though the method of installation is not a supported type

Understood.
However, considering the go tool command being added in the official Go toolchain, this method of installation is only going to get more popular. It might be worth considering support for it.

[nicksnyder]

Marking this issue as closed since our dependencies have been updated again. We regularly update or dependencies, but issues like this will continue happening from time to time to the extent that any dependencies have backward incompatible changes. This is the nature of using the go tool command, it inherently leaks our dependencies into your build. We strongly recommend using another installation method if you care to avoid issues like this.