fix(go): honor install_before for module versions by mariusvniekerk · Pull Request #9097 · jdx/mise

mariusvniekerk · 2026-04-15T05:52:29Z

Summary

populate go: version metadata with release timestamps from the module proxy and go list -m -json
let install_before filter go: module versions instead of falling back to untimestamped candidates
add an e2e regression for explicit go: backend keys overriding the global install_before

Test Plan

cargo test parse_go_
mise run test:e2e e2e/cli/test_install_before_explicit_go_backend

Populate Go module version timestamps from proxy and go list metadata so date filters can pick an older release correctly. Add an explicit backend e2e regression covering local install_before precedence over the global setting.

gemini-code-assist

Code Review

This pull request enhances the Go backend by fetching and including module version metadata, such as creation timestamps, from both Go proxies and the local go CLI. It introduces concurrent fetching for proxy metadata and adds a new test case for the install_before setting. Feedback focuses on performance optimizations, specifically batching go list calls to avoid excessive process spawns, filtering versions before making network requests, and using Arc to reduce redundant allocations during concurrent tasks.

greptile-apps · 2026-04-15T05:57:46Z

Greptile Summary

This PR enriches go: module version listings with release timestamps, enabling install_before filtering to work for Go module backends. The proxy path concurrently fetches per-version .info metadata (capped at 20 in-flight requests via a semaphore), while the GOPROXY=direct fallback batches go list -m -json calls in groups of 50. Both paths populate VersionInfo.created_at with RFC 3339 timestamps, which the existing filter_by_date logic already handles. The two previously flagged concerns (unbounded concurrency, sequential subprocesses) are addressed in the referenced commit.

Confidence Score: 5/5

Safe to merge — no P0 or P1 issues found; both concurrency and batching concerns from prior review are resolved.

All logic paths are sound: proxy key matching uses consistent v-prefixed strings throughout, semaphore prevents unbounded fanout, batched go list replaces sequential subprocesses, and the RFC 3339 timestamp format is compatible with the existing parse_into_timestamp handler. Versions whose timestamps can't be fetched gracefully fall back to created_at: None (included regardless of install_before), which is the correct safe default. No P0 or P1 findings remain.

No files require special attention.

Important Files Changed

Filename	Overview
src/backend/go.rs	Adds GoModuleVersionMetadata struct, ProxyVersionInfoResult enum, fetch_proxy_version_infos (semaphore-bounded concurrent HTTP) and fetch_go_module_version_infos (batched go list) to populate VersionInfo.created_at for install_before filtering; logic is sound with correct key matching and safe timestamp-missing fallback.
e2e/cli/test_install_before_explicit_go_backend	New e2e test covering tool-level install_before overriding the global setting for go: backend; correctly exercises both directions but depends on a live external module with pinned release dates (risk acknowledged by author in prior thread).

Sequence Diagram

sequenceDiagram
    participant CLI
    participant GoBackend
    participant ProxyPath as fetch_proxy_versions
    participant DirectPath as fetch_go_module_versions

    CLI->>GoBackend: _list_remote_versions()
    GoBackend->>ProxyPath: fetch_proxy_versions(tool_name)
    ProxyPath->>ProxyPath: query_proxy_list() [per candidate path]
    alt versions found in proxy list
        ProxyPath->>ProxyPath: fetch_proxy_version_infos()<br/>[semaphore, 20 concurrent]
        loop per version (max 20 at once)
            ProxyPath->>ProxyPath: query_proxy_version_metadata<br/>(/@v/{version}.info)
        end
        ProxyPath-->>GoBackend: Vec<VersionInfo> with created_at
    else empty list (pseudo-versions)
        ProxyPath->>ProxyPath: query_proxy_latest(/@latest)
        ProxyPath-->>GoBackend: Vec<VersionInfo> with created_at
    else proxy unavailable (GOPROXY=direct)
        ProxyPath-->>GoBackend: None
        GoBackend->>DirectPath: fetch_go_module_versions(config, mod_path)
        DirectPath->>DirectPath: go list -m -versions -json mod_path
        DirectPath->>DirectPath: fetch_go_module_version_infos()<br/>[batches of 50]
        loop per chunk of 50 versions
            DirectPath->>DirectPath: go list -mod=readonly -m -json<br/>mod@v1 mod@v2 ... (up to 50)
        end
        DirectPath-->>GoBackend: Vec<VersionInfo> with created_at
    end
    GoBackend-->>CLI: filter_by_date(versions, install_before)

_{Reviews (2): Last reviewed commit: "[autofix.ci] apply automated fixes" | Re-trigger Greptile}

greptile-apps · 2026-04-15T05:57:51Z

+'go:github.com/roborev-dev/roborev/cmd/roborev' = { version = "latest", install_before = "2026-04-07" }
+EOF
+
+assert_contains "mise install --dry-run 2>&1" "go:github.com/roborev-dev/roborev/cmd/roborev@0.50.0"


Hardcoded version expectations on a live external module

Both assertions rely on roborev having 0.50.0 released before 2026-04-07 and 0.51.0 released on or after that date. If the upstream author yanks a release, renames a tag, or the module proxy indexes the timestamp differently, CI will fail with no obvious connection to this PR's code. The second scenario (tool-level install_before = "2100-01-01" overriding the stricter global) is particularly worth keeping—just worth noting the external dependency risk.

Left unchanged for now. The risk is real: this test depends on a live external module with pinned release dates. I kept it because it exercises the exact quoted explicit go: backend path that regressed, and the repo already has slow/networked Go e2e coverage. If maintainers want a less brittle version, I can follow up with a more isolated fixture.

This comment was generated by Codex

Filter invalid proxy versions before requesting metadata, cap proxy info fan-out, and batch direct-mode { "Path": "command-line-arguments", "Main": true, "GoVersion": "1.26.2" } lookups into bounded chunks. This keeps the new timestamp enrichment path from doing one request or process per version without changing install_before behavior.

@mariusvniekerk

### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](#9097) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](#9097) - @mcncl made their first contribution in [#9096](#9096) - @Oyami-Srk made their first contribution in [#9099](#9099)

@mariusvniekerk

### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](#9097) - **(schema)** support os arch filters by @risu729 in [#9095](#9095) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](#9097) - @mcncl made their first contribution in [#9096](#9096) - @Oyami-Srk made their first contribution in [#9099](#9099)

@jdx

## [2026.4.14](https://github.com/jdx/mise/compare/v2026.4.13..v2026.4.14) - 2026-04-15 ### Chore - bump sigstore-verification by @jdx in [#9128](jdx/mise#9128) ## [2026.4.13](https://github.com/jdx/mise/compare/v2026.4.12..v2026.4.13) - 2026-04-15 ### 🐛 Bug Fixes - **(go)** honor install_before for module versions by @mariusvniekerk in [#9097](jdx/mise#9097) - **(vfox-plugin)** support Git URL with commit hash for mise.toml by @Oyami-Srk in [#9099](jdx/mise#9099) - `MISE_FETCH_REMOTE_VERSIONS_CACHE` not respected by @mcncl in [#9096](jdx/mise#9096) ### 📦️ Dependency Updates - unblock cargo-deny advisories check by @jdx in [#9112](jdx/mise#9112) ### New Contributors - @mariusvniekerk made their first contribution in [#9097](jdx/mise#9097) - @mcncl made their first contribution in [#9096](jdx/mise#9096) - @Oyami-Srk made their first contribution in [#9099](jdx/mise#9099) ## [2026.4.12](https://github.com/jdx/mise/compare/v2026.4.11..v2026.4.12) - 2026-04-15 ### 🚀 Features - **(npm)** use --min-release-age for npm 11.10.0+ supply chain protection by @webkaz in [#9072](jdx/mise#9072) - **(registry)** add openfga by @mnm364 in [#9084](jdx/mise#9084) - **(task)** allow to set confirmation default by @roele in [#9089](jdx/mise#9089) - support os/arch compound syntax in tool os filtering by @RobertDeRose in [#9088](jdx/mise#9088) ### 🐛 Bug Fixes - **(activate)** export __MISE_EXE and resolve bare ARGV0 to absolute path by @fru1tworld in [#9081](jdx/mise#9081) - **(install)** support aliased installs sharing a backend by @jdx in [#9093](jdx/mise#9093) - **(shim)** use which_no_shims when resolving mise binary in reshim and doctor by @kevinswiber in [#9071](jdx/mise#9071) - filter empty segments in colon-separated env var parsing by @baby-joel in [#9076](jdx/mise#9076) ### 📚 Documentation - fix wrong file reference to forgejo backend implemenation by @roele in [#9090](jdx/mise#9090) - fix cli token command for token resolution by @roele in [#9077](jdx/mise#9077)

fix(go): honor install_before for module versions

be8e2ee

Populate Go module version timestamps from proxy and go list metadata so date filters can pick an older release correctly. Add an explicit backend e2e regression covering local install_before precedence over the global setting.

gemini-code-assist Bot reviewed Apr 15, 2026

View reviewed changes

Comment thread src/backend/go.rs Outdated

Comment thread src/backend/go.rs Outdated

Comment thread src/backend/go.rs

greptile-apps Bot reviewed Apr 15, 2026

View reviewed changes

mariusvniekerk and others added 2 commits April 15, 2026 02:17

[autofix.ci] apply automated fixes

01d02cd

jdx merged commit 3a7623c into jdx:main Apr 15, 2026
34 checks passed

mise-en-dev mentioned this pull request Apr 15, 2026

chore: release 2026.4.13 #9114

Merged

mise-en-dev mentioned this pull request Apr 15, 2026

chore: release 2026.4.14 #9115

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(go): honor install_before for module versions#9097

fix(go): honor install_before for module versions#9097
jdx merged 3 commits intojdx:mainfrom
mariusvniekerk:fix/go-install-before-timestamps

mariusvniekerk commented Apr 15, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot Apr 15, 2026

Uh oh!

mariusvniekerk Apr 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mariusvniekerk commented Apr 15, 2026

Summary

Test Plan

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

mariusvniekerk Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Apr 15, 2026 •

edited

Loading

mariusvniekerk Apr 15, 2026 •

edited

Loading