{
  "id": 17603363,
  "title": "We moved one Go variable and every copy of our new CLI was told to upgrade",
  "url": "https://urgent.news/2026/11/01/we-moved-one-go-variable-and-every-copy-of-our-new-cli-was-told-to",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-01T13:16:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sergey_shinder_ab2d943365/we-moved-one-go-variable-and-every-copy-of-our-new-cli-was-told-to-upgrade-175d"
  },
  "original_language": "en",
  "account": "Version 2.7.0 of the command line tool was released on a Tuesday in September. However, by Wednesday afternoon, support was overwhelmed with forty tickets all citing the same issue: commands responded with messages demanding users upgrade their client as it was deemed too old. The tool inherently learns its version during the build process. The release workflow compiles the tool using the 'go build' command and an 'ldflags' option that sets a version string in the package main. This variable was moved to a package named 'internal/buildinfo' in version 2.7.0, and the ldflags line in the workflow still referenced 'main.version'. Despite the build process passing without errors, every signed and published binary perceived itself as 'dev'. This misidentification persisted because the Go linker ignored undefined symbols, including the newly placed version string. The tool included its version in a header on every request, and the API gateway started refusing clients older than version 2.4.0 due to the removal of a dependent endpoint. The gateway's handling of unreadable versions improved, allowing them through but logging them for review. A default version resembling a real one could bypass all tests and reach production undetected. The release workflow now verifies the binary's version command against the release tag before signing, preventing the inadvertent distribution of outdated software.",
  "summary": "We publish a command line tool that our partners use to book collections and download labels from our API. Version 2.7.0 went out on a Tuesday in September. By Wednesday afternoon support had forty tickets, all saying the same thing: every command answered with a message telling them their client was too old and to upgrade. They had all just upgraded. The tool learns its own version at build…",
  "key_points": [
    "Go variable moved to internal/buildinfo package",
    "ldflags still referenced main.version",
    "Release workflow verifies binary version before signing"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}