Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes

[Michael Orlitzky <michael () orlitzky com>]

On 2026-04-20 13:10:13, Demi Marie Obenour wrote:
> I wonder if build infra needs to be updated to support automated
> rebuilds when a reverse dependency is updated.  My understanding is
> that FreeBSD ports, Nix, and OBS already support this.

On its own this isn't sufficient because many packages pin their
dependencies to specific versions or git commits. This causes a
cascade of problems:

 * Most dependencies can't be packaged separately, because eventually
   two applications will require two different versions of the same
   library, not to mention the labor involved.

 * You can try to loosen the dependency constraints yourself, but with
   everyone else bundling, no one cares about API/ABI stability and
   breakage is likely.

 * OTOH with dependencies left bundled and pinned to specific
   versions, rebuilding does nothing except change mtimes.

Attachment: signature.asc
Description: