The auto-generated upstream-bump PR for libfossil v0.5.0 (#121) only updated the root go.mod. leaf/go.mod and bridge/go.mod independently pin libfossil and stayed on v0.4.5 until I extended the PR by hand.

Walk every go.mod file in the repo, skip ones that don't depend on the target module (so go get doesn't add it as a new dep), then run go get + go mod tidy in each. Verify-build and the git-add for the commit also iterate the same set.

The find-based discovery automatically picks up future modules — when the hub package is promoted to its own go.mod (#118) or any other new module is added, no workflow change is needed.

Verified by dry-running the find/grep logic locally against this repo's main: correctly identifies ./, leaf/, bridge/ as libfossil dependants and skips ./docs/site/ (Hugo site, no libfossil).

Closes #127 check-in: adb39a9af9 user: [email protected] tags: trunk