v0.14.8 breaking build

[Niiph]

Today's update of 0.14.8 caused errors on CI on my two ApiPlatform repositories, with message:

#36 31.63 github.com/dunglas/mercure/caddy imports
#36 31.63 	github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile imports
#36 31.63 	github.com/caddyserver/caddy/v2/modules/caddytls imports
#36 31.63 	github.com/smallstep/certificates/authority/provisioner imports
#36 31.63 	github.com/slackhq/nebula/cert imports
#36 31.63 	crypto/ecdh: package crypto/ecdh is not in GOROOT (/usr/local/go/src/crypto/ecdh)
#36 34.40 2023/05/22 16:36:03 [FATAL] exit status 1
#36 ERROR: executor failed running [/bin/sh -c xcaddy build 	--with github.com/dunglas/mercure 	--with github.com/dunglas/mercure/caddy 	--with github.com/dunglas/vulcain 	--with github.com/dunglas/vulcain/caddy]: exit code: 1
failed to solve: executor failed running [/bin/sh -c xcaddy build 	--with github.com/dunglas/mercure 	--with github.com/dunglas/mercure/caddy 	--with github.com/dunglas/vulcain 	--with github.com/dunglas/vulcain/caddy]: exit code: 1
------
 > [app_caddy_builder 2/2] RUN xcaddy build 	--with github.com/dunglas/mercure 	--with github.com/dunglas/mercure/caddy 	--with github.com/dunglas/vulcain 	--with github.com/dunglas/vulcain/caddy:
#36 22.75 go: downloading github.com/shurcooL/sanitized_anchor_name v1.0.0
#36 22.77 go: downloading github.com/mattn/go-colorable v0.1.13
#36 22.79 go: downloading github.com/mattn/go-isatty v0.0.19
#36 31.63 github.com/dunglas/mercure/caddy imports
#36 31.63 	github.com/caddyserver/caddy/v2/caddyconfig/httpcaddyfile imports
#36 31.63 	github.com/caddyserver/caddy/v2/modules/caddytls imports
#36 31.63 	github.com/smallstep/certificates/authority/provisioner imports
#36 31.63 	github.com/slackhq/nebula/cert imports
#36 31.63 	crypto/ecdh: package crypto/ecdh is not in GOROOT (/usr/local/go/src/crypto/ecdh)
#36 34.40 2023/05/22 16:36:03 [FATAL] exit status 1
------
Error: Process completed with exit code 17.

After I locked caddy in dockerfile to:

RUN xcaddy build \
	--with github.com/dunglas/mercure/caddy@v0.14.6 \

It works fine

[dunglas]

The problem is that github.com/slackhq/nebula requires crypto/ecdh which is part of Go 1.20, and Caddy's base image is still using Go 1.19.
I don't know why xcaddy doesn't resolve the versions correctly (@mholt may have an idea), but a quick workaround is to use the 2.7 version of the Caddy builder:

-caddy:2.6-builder-alpine
+caddy:2.7-builder-alpine

[mholt]

I am not sure 🤔

I have a feeling it's not a problem with xcaddy or caddy code/repos, but rather the way Go modules works with relation to a plugin's go.mod. Maybe MVS or something?