Go packages without a go.mod
file are included as incompatible
in a dependent's go.mod
file but not traced by the script.
This was covered in the following issue:
grokify/go-aha#1
For example, when tracing github.com/miekg/dns
from github.com/grokify/go-aha v0.2.3
, we see the following:
https://github.com/grokify/go-aha/blob/v0.2.3/go.mod
〉ggdh 'github.com/miekg/dns'
github.com/grokify/go-aha
⬇
github.com/grokify/[email protected]
⬇
github.com/blend/[email protected]
⬇
github.com/spf13/[email protected]
⬇
github.com/spf13/[email protected]
⬇
github.com/bketelsen/[email protected]
⬇
github.com/hashicorp/consul/[email protected]
⬇
github.com/hashicorp/[email protected]
⬇
github.com/hashicorp/[email protected]
⬇
github.com/miekg/[email protected]
Specifically, it calls out the following which happens to be incomplete because a non-module Go package is skipped.
github.com/grokify/[email protected]
⬇
github.com/blend/[email protected]
The non-module Go package is github.com/wcharczuk/[email protected]+incompatible
and the actual dependency tree looks like the following.
github.com/grokify/[email protected]
⬇
github.com/wcharczuk/[email protected]+incompatible
⬇
github.com/blend/[email protected]
The github.com/grokify/[email protected]
go.mod
file looks like the following:
https://github.com/grokify/gocharts/blob/v1.16.3/go.mod
module github.com/grokify/gocharts
go 1.16
require (
github.com/360EntSecGroup-Skylar/excelize v1.4.1
github.com/blend/go-sdk v1.20211204.3 // indirect
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
github.com/grokify/elastirad-go v0.1.4
github.com/grokify/mogo v0.32.3
github.com/jessevdk/go-flags v1.5.0
github.com/mattn/go-runewidth v0.0.13 // indirect
github.com/olekukonko/tablewriter v0.0.5
github.com/pkg/errors v0.9.1
github.com/valyala/quicktemplate v1.7.0
github.com/wcharczuk/go-chart v2.0.1+incompatible
golang.org/x/sys v0.0.0-20211210111614-af8b64212486 // indirect
google.golang.org/protobuf v1.27.1 // indirect
)
Since github.com/wcharczuk/go-chart v2.0.1
doesn't have a go.mod
file, it's necessary to get the code and scan it.
I pulled down the code with:
$ git clone --branch v2.0.1 https://github.com/wcharczuk/go-chart
and then in ran a quick grep command on blend
to establish it is used, though a Go parser will want do do more.