Repository: etcd-io/etcd
File: scripts/update_dep.sh (Shell)

Code before:
#!/bin/bash 

# Usage:
#    ./scripts/update_dep.sh module version
# or ./scripts/update_dep.sh module
# e.g.
#   ./scripts/update_dep.sh github.com/golang/groupcache
#   ./scripts/update_dep.sh github.com/soheilhy/cmux v0.1.5
#
# Updates version of given dependency in all the modules that depend on the mod.

set -euo pipefail

source ./scripts/test_lib.sh

if [ "$#" -ne 2 ]; then
    echo "Illegal number of parameters"
    exit 1
fi

mod="$1"
ver="$2"

function print_current_dep_version {
  echo "${mod} version in all go mod files"
  grep --exclude-dir=.git --include=\*.mod -Ri "^.*${mod} v.*$" | grep -v sum
  printf "\n\n"
}

function is_fully_indirect {
  # check if all lines end with "// indirect"
  # if grep found nothing, the error code will be non-zero
  ALL=$(grep --exclude-dir=.git --include=\*.mod -Ri "^.*${mod} v.*$" | grep -v sum | wc -l)
  ONLY_INDIRECT=$(grep --exclude-dir=.git --include=\*.mod -Ri "^.*${mod} v.*// indirect$" | grep -v sum | wc -l)
  if  [[ "$ALL" == "$ONLY_INDIRECT" ]]; then 
      echo "Fully indirect, we will terminate the script"
      exit 1
  else
      echo "Not fully indirect, we will perform dependency bump"
  fi
}

function update_module {
  run go mod tidy

  deps=$(go list -f '{{if .Version}}{{.Path}},{{.Version}}{{end}}' -m all)
  if [[ "$deps" == *"${mod}"* ]]; then
    if [ -z "${ver}" ]; then
      run go get -u "${mod}"
    else
      run go get "${mod}@${ver}"
    fi
  fi
}

print_current_dep_version
is_fully_indirect
run_for_modules update_module

# check all dependencies across all go mod files have the same pinned version respectively
PASSES="dep" ./scripts/test.sh

./scripts/fix.sh
print_current_dep_version


Review comment (suggestion):
With the changes from the top of the file

```sh
if [ "$#" -ne 2 ]; then
    echo "Illegal number of parameters"
    exit 1
fi
```

We will never reach this conditional, as `${ver}` will never be empty.

Code after:

function update_module {
  local subdir
  subdir=$(module_subdir)

  # The `go get` command is most effective on dependencies that are explicitly
  # listed as direct requirements in the go.mod file. When updating a purely
  # indirect dependency, `go get` might not update it as expected.
  #
  # To work around this, we temporarily promote the indirect dependency to a
  # direct one in the go.mod file using `go mod edit`. This ensures that
  # `go get` will see and correctly update the module. Subsequent cleanup
  # commands (like `go mod tidy`) will automatically move it back
  # to an indirect dependency, but at the designated updated version.
  #
  # Note: `go mod edit` requires a specific version (e.g., v1.2.3), so we only
  # use it when a version is explicitly provided. For "latest", we skip this
  # step and let `go get -u` handle it directly.
  if [ -n "${ver}" ]; then
    run go mod edit -require "${mod}@${ver}" || true
  fi

  # Check if the module is a dependency.
  if go list -m all | grep -q -E "^\s*${mod}\s"; then
    log_info "  Updating in ${subdir}..."
    if [ -z "${ver}" ]; then
      run go get -u "${mod}"
    else
      run go get "${mod}@${ver}"
    fi
  fi
}

print_current_dep_version
if is_fully_indirect; then
  read -p "Module ${mod} is a purely indirect dependency. Are you sure you want to update it? [y/N] " -r confirm
  [[ "$confirm" == [Yy] ]] || exit # Default is No
fi

log_info "Updating '${mod}' to ${ver:-latest} across all modules..."
run_for_modules update_module

make fix-mod-tidy fix-bom update-go-workspace verify-dep

print_current_dep_version