gomod: Bumping a dependency that sets "go 1.21" in their go.mod sets "toolchain 1.21" in mine

[antifuchs]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

gomod

Package manager version

1.20

Language version

1.20

Manifest location and content before the Dependabot update

go.mod. Link to original module file: https://github.com/boinkor-net/tsnsrv/blob/469a5104d7914816d185fec37a031cc47b67f032/go.mod

dependabot.yml content

https://github.com/boinkor-net/tsnsrv/blob/469a5104d7914816d185fec37a031cc47b67f032/.github/dependabot.yml

Updated dependency

"tailscale" from v1.46.1 to v1.48.1

What you expected to see, versus what you actually saw

I was expecting this PR to only contain the version bump; however, it also added this line: https://github.com/boinkor-net/tsnsrv/pull/25/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R4

in diff form:

diff --git a/go.mod b/go.mod
index a6d61d9..73b1321 100644
--- a/go.mod
+++ b/go.mod
@@ -1,13 +1,14 @@
 module github.com/antifuchs/tsnsrv
 
 go 1.20
+toolchain go1.21.0
 
 require (
 	github.com/peterbourgon/ff/v3 v3.4.0
 	github.com/prometheus/client_golang v1.16.0
 	github.com/stretchr/testify v1.8.4
-	golang.org/x/exp v0.0.0-20230425010034-47ecfdc1ba53
-	tailscale.com v1.46.1
+	golang.org/x/exp v0.0.0-20230725093048-515e97ebf090
+	tailscale.com v1.48.1
 )
 
 require (
@@ -32,6 +33,7 @@ require (
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/coreos/go-iptables v0.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dblohm7/wingoes v0.0.0-20230803162905-5c6286bb8c6e // indirect
 	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect

note the "toolchain" line that directly contradicts the go line above it. Go 1.20 does not understand the "toolchain" keyword, and so the resulting PR build fails.

(aside, yep, apparently it's fine to link the tailscale library into a go 1.20 library, but yeah, I should upgrade that version as soon as my toolchain supports it.)

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

Find the PR at boinkor-net/tsnsrv#25

Smallest manifest that reproduces the issue

No response

[jakecoffman]

Thanks for reporting this, looks like we need to set GOTOOLCHAIN to the version specified in the go.mod.

[jakecoffman]

@antifuchs should be working now if you want to give that PR a @dependabot recreate comment and try it out.

[antifuchs]

OK, that looks far more reasonable! Confirmed that it's the expected result, thank you (:

[spencerschrock]

I'm seeing this toolchain insertion behavior happening again, this time with 1.22:
ossf/scorecard#3928

go 1.21.5
+toolchain go1.22.1

I can open a separate issue if preferred, but was trying to avoid duplicates

[janisz]

I created a PR about toolchain removal #9422