go-depdiffs

Go Dependency Update API Diffs!

This is an experimental attempt to give module consumers more insight into the risks of dependency updates, I've combined go list -u with golang.org/x/exp/apidiff.

This tool loads modules at their current and updated versions from the local Go module cache, and gets a report of their API differences. Updated modules, if not present, are fetched with go mod download.

• If a module cannot be loaded for any reason, its risk is considered "unknown".
• If a module update is found to have incompatible diffs (as defined by apidiff), the update is marked as high risk.
• If no incompatible diffs are found, the update is considered low risk.

Usage

With no arguments, the tool will print the risk level of each update:

go-depdiffs 

✅ Low Risk Update: go get google.golang.org/[email protected]
🚩️ Incompatible Update to google.golang.org/[email protected]

Flags

• -v will include details of the API diffs. It also adds some additional logging about module loading errors.
• --risk (low|medium|high|unknown) limits the output to updates of only the specified risk. useful for examining diffs when combined with -v.
• --json output json objects instead of strings. useful for piping into go get commands.

Examples

go-depdiffs 

✅ Low Risk Update: go get google.golang.org/[email protected]
🚩️ Incompatible Update to google.golang.org/[email protected]

To update all low-risk dependencies:

go-diffdeps --risk low --json 2>/dev/null | jq '. | "\(.Path)@\(.UpdateVersion)"' | xargs go get

To review high risk dependencies:

go-diffdeps --risk high -v 

🚩️ Incompatible Update to google.golang.org/[email protected]:
 google.golang.org/grpc.Version: value changed from "1.73.0" to "1.75.1"