Today we have make modcheck in our verify flow. It compares the versions of dependencies in the root go.mod with those in apis/go.mod and fails if there are discrepancies. The idea is to force us to keep those dependencies in sync so that downstreams consuming apis/ get the same behavior we do natively.

When make modcheck fails, our recourse is to manually copy the versions from one go.mod to the other (and then go mod tidy etc.). For convenience, we should be able to e.g. run make modfix which would run modcheck -f which would make the actual edits to apis/go.mod. This should all be relatively straightforward using the modfile library – though it'll take a little refactoring of the current modcheck.go.