From 75b5189e4b924e47f23e19ca36e49a9cc685a7dd Mon Sep 17 00:00:00 2001 From: August Vi Date: Mon, 19 Oct 2026 07:53:33 -0700 Subject: [PATCH] Prepare v1.4.2: retract the upstream tags under this module path and write the changelog entry. --- .github/ISSUE_TEMPLATE/bug_report.yml | 2 +- CHANGELOG.md | 26 ++++++++++++++++++++++++-- README.md | 13 +++++++------ go.mod | 4 ++++ 4 files changed, 36 insertions(+), 9 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index 30fa478..6b23da7 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -7,7 +7,7 @@ body: attributes: label: Versions description: sqlx, Go, the driver and the database, each with its version - placeholder: sqlx v1.4.1, go1.27.2, lib/pq v1.10.9, PostgreSQL 16 + placeholder: sqlx v1.4.2, go1.27.2, lib/pq v1.10.9, PostgreSQL 16 validations: required: true - type: textarea diff --git a/CHANGELOG.md b/CHANGELOG.md index f534d4e..7d0c790 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,11 @@ Notable changes to this fork, newest first. An entry that imports an upstream pull request names its number and author. Releases up to v1.4.0 are releases of upstream [jmoiron/sqlx](https://github.com/jmoiron/sqlx). -## Unreleased +## v1.4.2 (2026-10-19) + +No API change. sqlx's `go.mod` now requires no other module, so importing sqlx +no longer changes which database driver versions a program builds with, and the +upstream tags that came with the fork's history are retracted. ### Module and toolchain @@ -15,7 +19,25 @@ upstream [jmoiron/sqlx](https://github.com/jmoiron/sqlx). minimum version selection raised a consumer's own MySQL driver to v1.10.1 even though sqlx only used it in tests (upstream #642, #569, #849). The checks in three tests that read the unexported `unsafe` field now test its - effect instead: scanning into a struct that lacks some selected columns. + effect instead: scanning into a struct that lacks some selected columns + (#34). +- v1.2.0 to v1.4.0 are retracted under this module path. They are upstream's + tags, pushed with the history; their `go.mod` declares + `github.com/jmoiron/sqlx`, so `go get github.com/secondwindoss/sqlx@v1.4.0` + failed with a module path error. `go list -m -versions` now lists only the + fork's own releases (#35). + +### Project + +- Release tags are signed; GitHub shows them as verified. +- An OpenSSF Scorecard workflow publishes the repository's score, shown as a + README badge; CI actions are pinned by commit SHA; Go fuzz tests cover the + SQL scanner, `Rebind`, `compileNamedQuery` and `In`, and their seed corpus + runs with the unit tests (#32, #33). CodeQL scans every pull request, and + merging into `master` requires the CI checks to pass. +- The README is rewritten around the fork, with a migration section that + explains why a `replace` directive cannot stand in for the import rewrite + (#28, #29, #30). ## v1.4.1 (2026-10-10) diff --git a/README.md b/README.md index 2dab66f..c5667fe 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ and go from query to struct in one call with `Get` and `Select`. | | jmoiron/sqlx | secondwindoss/sqlx | |--------------------|------------------------------|-----------------------------------| -| Last release | v1.4.0, April 2024 | v1.4.1, October 2026 | +| Last release | v1.4.0, April 2024 | v1.4.2, October 2026 | | Last commit | May 2024 | active | | Open pull requests | 79 (October 2026) | 0, the fixes are merged | | Go support | `go 1.10`, untested | Go 1.24 and newer, tested | @@ -49,7 +49,7 @@ and go from query to struct in one call with `Get` and `Select`. ## Quick start - go get github.com/secondwindoss/sqlx@v1.4.1 + go get github.com/secondwindoss/sqlx@v1.4.2 sqlx requires Go 1.24 or newer. @@ -109,19 +109,20 @@ Rewrite the import path, then update the dependency. macOS: grep -rl 'github.com/jmoiron/sqlx' --include='*.go' . | xargs sed -i '' 's#github.com/jmoiron/sqlx#github.com/secondwindoss/sqlx#g' - go get github.com/secondwindoss/sqlx@v1.4.1 + go get github.com/secondwindoss/sqlx@v1.4.2 go mod tidy Linux: grep -rl 'github.com/jmoiron/sqlx' --include='*.go' . | xargs sed -i 's#github.com/jmoiron/sqlx#github.com/secondwindoss/sqlx#g' - go get github.com/secondwindoss/sqlx@v1.4.1 + go get github.com/secondwindoss/sqlx@v1.4.2 go mod tidy Tags up to v1.4.0 are upstream's and declare the upstream module path, so -v1.4.1 is the first version that resolves under the new path. +v1.4.1 is the first version that resolves under the new path; v1.4.2 retracts +the older tags so the go command no longer offers them. -A `replace github.com/jmoiron/sqlx => github.com/secondwindoss/sqlx v1.4.1` +A `replace github.com/jmoiron/sqlx => github.com/secondwindoss/sqlx v1.4.2` directive does not work: the fork imports its own `reflectx` package under the new path, and Go refuses to use one module under two paths. Rewrite the imports instead. diff --git a/go.mod b/go.mod index a7c5b60..1e90430 100644 --- a/go.mod +++ b/go.mod @@ -1,3 +1,7 @@ module github.com/secondwindoss/sqlx go 1.24.0 + +// Upstream jmoiron/sqlx tags that came with the fork's history. Their go.mod +// declares github.com/jmoiron/sqlx, so they cannot be used under this path. +retract [v1.2.0, v1.4.0]