Bump go mod version back down to 1.20

[nathanperkins]

tl;dr - revert the go mod version from 1.21 back to 1.20 to avoid this module forcing downstream modules to upgrade

• Full context: PSA in kubernetes/kubernetes
• Proposed long-term solution: golang proposal

In 1.21, the go tooling introduced new go mod management behavior where a repo's go mod version, like go 1.20 will automatically be upgraded if it is less than the minimum go mod version of any of its dependencies.

For example, if I have a module using 1.20 and I import a module which uses 1.21, running go mod tidy will update my module to 1.21.

Unfortunately, this makes it hard for us to maintain stable releases because bumping any dependency to resolve a CVE may force us to bump the go mod version, which introduces potentially undesirable changes to the runtime behavior. We are seeing that in our projects which import mdlayher/socket right now.

The go team is considering a proposal which can mitigate this issue, and we are waiting to see when it will be delivered. We are hoping for 1.23.

Until then, could we set this project's go.mod version back to 1.20 so that importing this repo doesn't force other projects to upgrade? If there is no 1.21+ feature used in the repo, then this should essentially be a no-op.

[nathanperkins]

@mdlayher will this automatically release as a new version or do we need to manually tag?

[nathanperkins]

Thank you for merging the fix! :)

[mdlayher]

No problem, thank you for the pr! I will cut a tag tomorrow with a script but you can always pull at latest for gomod.