[BUG] go mod tidy pulls the most recent versions of 4 dependencies which have incompatible API changes

[markkurossi]

I create a new project using main version for github.com/bytemare/frost. The go mod tidy in my new repository pulls the latest versions of:

• github.com/bytemare/ecc
• github.com/bytemare/hash
• github.com/bytemare/secret-sharing
• github.com/gtank/ristretto255

These versions have some minimal API changes that fail the build.

$ go build
# github.com/bytemare/frost/internal
/Users/mtr/go/pkg/mod/github.com/bytemare/frost@v0.0.0-20241019112700-8c6db5b04145/internal/hashing.go:65:64: too many arguments in call to ciphersuites[ecc.Edwards25519Sha512 - 1].hash.Hash
	have (number, [][]byte...)
	want (...[]byte)
/Users/mtr/go/pkg/mod/github.com/bytemare/frost@v0.0.0-20241019112700-8c6db5b04145/internal/hashing.go:90:20: cannot use 0 (untyped int constant) as []byte value in argument to c.hash.Hash
/Users/mtr/go/pkg/mod/github.com/bytemare/frost@v0.0.0-20241019112700-8c6db5b04145/internal/hashing.go:131:22: cannot use 0 (untyped int constant) as []byte value in argument to cs.hash.Hash
/Users/mtr/go/pkg/mod/github.com/bytemare/frost@v0.0.0-20241019112700-8c6db5b04145/internal/hashing.go:137:22: cannot use 0 (untyped int constant) as []byte value in argument to cs.hash.Hash

Your setup

I am using the head of the main branch:

github.com/bytemare/frost v0.0.0-20241019112700-8c6db5b04145

$ go version
go version go1.25.0 darwin/amd64

What does the go environment look like?

go env Output

$ go env
AR='ar'
CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/Users/mtr/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/mtr/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/rp/_y014fx17fx5ydd8vrc7lkpm0000gn/T/go-build1887451462=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='amd64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/Users/mtr/go/src/github.com/markkurossi/hello/frost/go.mod'
GOMODCACHE='/Users/mtr/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/mtr/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/mtr/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_amd64'
GOVCS=''
GOVERSION='go1.25.0'
GOWORK=''
PKG_CONFIG='pkg-config'

Reproducing

What did you do?
Steps to reproduce the behavior:

1. create a new project and import:

import (
	"github.com/bytemare/frost"
	"github.com/bytemare/frost/debug"
	"github.com/bytemare/secret-sharing/keys"
)

2. Build the project
3. The build fails because of the API changes.

Expected behavior
The project would compile cleanly.

Additional context
The diff is quite minimalistic, touching only:

• debug/debug.go
• go.mod
• go.sum
• internal/hashing.go
• tests/encoding_test.go

[bytemare]

Hi @markkurossi 👋

My apologies, the module is a bit behind on the recent upstream updates. This will be fixed soon. Thank you for flagging this!

[gg718]

@bytemare Would you accept a PR to fix this? I'm currently having to add gnarly replace statements in my go.mod to keep updates compatible.

[bytemare]

Hi @markkurossi and @gg718 👋

My apologies. I'm currently bubbling up dependency upgrades upstream, that take longer than expected. I hope to land it this week.