Question on module versioning expected behavior

[Marcin Romaszewicz]

I recently hit a little issue with go.mod versioning that's confusing me. My go.mod is straightforward:

https://github.com/deepmap/oapi-codegen/blob/master/go.mod

One of the packages in there is kin-openapi at v0.47.0:

github.com/getkin/kin-openapi v0.47.0

We briefly had some code in the repo which referred to some files which weren't present in kin-o...@v0.47.0, but these files were present in kin-o...@0.52.0

https://github.com/deepmap/oapi-codegen/pull/322

I would have expected that files not being present in 0.47.0 would result in a compiler error, but instead, what happened is that my go.mod had its kin-openapi requirement increased to 0.52.0 automatically by go build.

It's surprising to me that Go is smart enough to figure out that a subsequent version of that module contains what I'm looking for, and it updates go.mod. In my case, this isn't the behavior that I wanted. So, is there a way disable this automated roll-up? I want my code to break if I refer to something in a newer package.

Thanks,

-- Marcin

[Sean Liao]

go1.16 defaults to `-mod=readonly`, so a build will fail with:

```

fix/kin-51-compat » go build ./...

pkg/chi-middleware/oapi_validate.go:14:2: no required module provides package github.com/getkin/kin-openapi/routers; to add it:

go get github.com/getkin/kin-openapi/routers

pkg/chi-middleware/oapi_validate.go:15:2: no required module provides package github.com/getkin/kin-openapi/routers/legacy; to add it:

go get github.com/getkin/kin-openapi/routers/legacy

```

Previous versions default to `-mod=mod` which modifies / upgrades dependencies as necessary for all commands