internal/mod/modload: sort module versions when adding a new dependency

Otherwise, if a module already depends on [email protected] and we run

    cue mod get [email protected]

we get a panic due to the new module version being out of order:

    panic: NewRequirements called with unsorted roots: [[email protected] [email protected]]

The test case reproduced the panic without the fix.
Due to the fact that the test panicked, we could not add it
in an earlier commit to demonstrate the bug.

All other callers to modrequirements.NewRequirements obtain module
version lists from methods such as modfile.File.DepVersions,
which are already guaranteed to be sorted. newVersions, however,
is a newly constructed list taking the user's arguments
and needs to be sorted before being used.

Fixes #3499.

Signed-off-by: Daniel Martí <[email protected]>
Change-Id: I1543879981d3fa473aae53fecbffa136178c70bf
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1205761
Unity-Result: CUE porcuepine <[email protected]>
TryBot-Result: CUEcueckoo <[email protected]>
Reviewed-by: Rustam Abdullaev <[email protected]>
Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1205928
Reviewed-by: Paul Jolly <[email protected]>

internal/mod/modload/testdata/updateversions/issue3499.txtar

@@ -0,0 +1,41 @@
+# Test that adding a new dependency which goes before an existing one
+# does not panic due to an unsorted list of module versions.
+-- versions --
+bar.com
+-- want --
+module: "main.org@v0"
+language: {
+	version: "v0.8.0"
+}
+deps: {
+	"bar.com@v0": {
+		v: "v0.0.1"
+	}
+	"foo.com@v0": {
+		v: "v0.0.1"
+	}
+}
+-- cue.mod/module.cue --
+module: "main.org@v0"
+language: version: "v0.8.0"
+deps: {
+	"foo.com@v0": {
+		v: "v0.0.1"
+	}
+}
+-- main.cue --
+package main
+
+-- _registry/foo.com_v0.0.1/cue.mod/module.cue --
+module: "foo.com@v0"
+language: version: "v0.8.0"
+
+-- _registry/foo.com_v0.0.1/foo/x.cue --
+package foo
+
+-- _registry/bar.com_v0.0.1/cue.mod/module.cue --
+module: "bar.com@v0"
+language: version: "v0.8.0"
+
+-- _registry/bar.com_v0.0.1/bar/x.cue --
+package bar

internal/mod/modload/update.go

@@ -73,6 +73,7 @@ func UpdateVersions(ctx context.Context, fsys fs.FS, modRoot string, reg Registr
 	for _, v := range mversionsMap {
 		newVersions = append(newVersions, v)
 	}
+	module.Sort(newVersions)
 	rs = modrequirements.NewRequirements(mf.QualifiedModule(), reg, newVersions, mf.DefaultMajorVersions())
 	g, err = rs.Graph(ctx)
 	if err != nil {