Fix Go dependencies

[2opremio]

#5084 broke the Go dependencies, because:

1. go mod tidy wasn't invoked before merging leading to a misaligned Go version in go.mod (we should probably enforce this in CI and make sure there are no diffs)
2. It ugraded github.com/creachadair/jrpc2 to 1.1.1 which requires Go 1.21 (breaking the two-Go-release compatibility guarantee we make)

[2opremio]

https://github.com/stellar/soroban-tools is also broken. We should fix it next

[tsachiherman]

I'm surprised you're saying that go mod tidy wasn't called. I did call that, and deployed 1.19 before doing that.

Also, if it broke the build, how come all the CI tests passed ?!

[2opremio]

It wasn't (at least if you were running Go 1.21 locally), since otherwise it would had written 1.21 to go.mod (just try it locally)

[2opremio]

Also, if it broke the build, how come all the CI tests passed ?!

I never wrote it broke the build, it broke the two-Golang release policy. I guess CI works because Go updates go.mod when building with 1.21 (or does a best effort when using an earlier version)

[tsachiherman]

Also, if it broke the build, how come all the CI tests passed ?!

I never wrote it broke the build, it broke the two-Golang release policy. I guess CI works because Go updates go.mod when building with 1.21 (or does a best effort when using an earlier version)

that's a bit concerning. should we add a test to verify that the go.mod/go.sum doesn't get updated during the build ? i.e. so that it's only developer-driven ?

[2opremio]

that's a bit concerning. should we add a test to verify that the go.mod/go.sum doesn't get updated during the build ? i.e. so that it's only developer-driven ?

Yes, I suggested that in the PR description:

we should probably enforce this in CI and make sure there are no diffs

[leighmcculloch]

I guess CI works because Go updates go.mod when building with 1.21

This is surprising. Go since version 1.16 has not updated the go.mod automatically.

In the release notes for Go 1.16 it says:

Build commands like go build and go test no longer modify go.mod and go.sum by default. Instead, they report an error if a module requirement or checksum needs to be added or updated

Ref: https://go.dev/doc/go1.16

This was strengthened in Go 1.18 with additional commands being changed to not modify go.mod:

Automatic go.mod and go.sum updates

The go mod graph, go mod vendor, go mod verify, and go mod why subcommands no longer automatically update the go.mod and go.sum files. (Those files can be updated explicitly using go get, go mod tidy, or go mod download.)

Ref: https://go.dev/doc/go1.18

I think something else is probably happening.