Yuxuan 'fishy' Wang

@fmeum sure. what's the best way to use an untagged version (a version between 0.39.0 and 0.40.0) with bzlmod?

`git bisect` shows that https://github.com/bazel-contrib/bazel-gazelle/commit/bf8c993756d01e8e45bde50ba22a78e5edbe64b4 is the first bad commit, which is probably not that useful 😥

Actually fsnotify is also used by gazelle and that's the commit bumped it to 1.8.0: https://github.com/bazel-contrib/bazel-gazelle/commit/bf8c993756d01e8e45bde50ba22a78e5edbe64b4#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R11 I wonder if that's the issue.

Here's a minimal reproducer: ``` $ cat BUILD.bazel load("@gazelle//:def.bzl", "gazelle") load("@rules_go//go:def.bzl", "go_binary", "go_library") gazelle(name = "gazelle") go_library( name = "test-gazelle_lib", srcs = ["main.go"], importpath = "github.com/fishy/test-gazelle", visibility = ["//visibility:private"], deps...

gazelle is not in the dependency tree of the go project (it's used by the build system), so I'm not sure why mixing gazelle's dependency to go project's dependency is...

hmm `go_deps.config(check_direct_dependencies = "error")` works for the minimal reproducer (it fails when I use gazelle 0.40.0 and don't use `go mod edit --replace` to pin fsnotify to 1.7.0), but it...

or maybe that only works for direct dependencies, and won't work for indirect dependencies? (in minimal reproducer it's direct dependency, for the bigger project it's an indirect one)

After changing the minimal reproducer to make fsnotify an indirect dependency, confirmed that `go_deps.config(check_direct_dependencies = "error")` no longer causes it to fail. I think that's a bug?

I was hoping to rely on `go_deps.config(check_direct_dependencies = "error")` to notify us that there's an unexpected version of a (direct or indirect) dependency pulled in, and we need to pin...

hmm the button is suddenly back.