cmd/go: "mod tidy" remove necessary "require" statement

[linzhp]

What version of Go are you using (go version)?

$ go version
go version go1.13.4 darwin/amd64

Does this issue reproduce with the latest release?

It can be reproduced in go version devel +0377f06168 Tue Dec 17 20:57:06 2019 +0000 darwin/amd64

The issue cannot be reproduced in Go 1.12.13.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/zplin/Library/Caches/go-build"
GOENV="/Users/zplin/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/zplin/gocode"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.13.4/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.13.4/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/zplin/gocode/src/github.com/linzhp/go_examples/hyphen/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/bf/3ympgpy92txgknkb4z30dldh0000gn/T/go-build350719411=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

git clone git@github.com:linzhp/go_examples.git
cd go_examples/hyphen
go mod tidy

What did you expect to see?

"go mod tidy" finishes successfully.

What did you see instead?

The line "github.com/hexonet/go-sdk v1.2.1 // indirect" in go_examples/hyphen/go.mod is removed. "go mod" tried to use github.com/hexonet/go-sdk@v2.2.3+incompatible instead, resulting an error:

github.com/linzhp/go_examples/hyphen imports
	github.com/StackExchange/dnscontrol/providers/hexonet imports
	github.com/hexonet/go-sdk/client: module github.com/hexonet/go-sdk@latest found (v2.2.3+incompatible), but does not contain package github.com/hexonet/go-sdk/client
github.com/linzhp/go_examples/hyphen imports
	github.com/StackExchange/dnscontrol/providers/hexonet imports
	github.com/hexonet/go-sdk/response/listresponse: module github.com/hexonet/go-sdk@latest found (v2.2.3+incompatible), but does not contain package github.com/hexonet/go-sdk/response/listresponse

[agnivade]

@bcmills @jayconrod

[jayconrod]

I checked out the repo. It looks like any command will remove the requirement on github.com/hexonet/go-sdk v1.2.1. go mod graph shows that github.com/linzhp/go_examples/modEnabled requires github.com/hexonet/go-sdk@v2.2.3+incompatible. Since a higher version of go-sdk is required by a dependency, the minimum version v1.2.1 is removed, since it has no effect.

You could try go get -d github.com/hexonet/go-sdk@v1.2.1. This will downgrade or remove modules that require higher versions. If you still need those versions, then I'm afraid you may have a diamond dependency problem.

[bcmills]

Duplicate of #33284

[linzhp]

@jayconrod

github.com/linzhp/go_examples/modEnabled requires github.com/hexonet/go-sdk@v2.2.3+incompatible.

This is not true... The mod file of modEnabled requires github.com/hexonet/go-sdk@v1.2.1. It is ignored by Go mod, so both "go mod tidy" and "go mod graph" only sees v2.2.3+incompatible, which is exactly what issue is about.

@bcmills Why do you think this issues is a duplicate of a logging issue?

[bcmills]

@linzhp, the fact that the version is changed is due to the existing requirement on github.com/linzhp/go_examples/modEnabled v0.0.0-20191218021247-9c176d4a652d, which does indeed require v2.2.3+incompatible.

[bcmills]

So this is a logging problem, because we are not logging the most important piece of information that would help you debug the situation: specifically, the fact that github.com/hexonet/go-sdk was upgraded from v1.2.1 to v2.2.3+incompatible during version selection due to the existing requirement on github.com/linzhp/go_examples/modEnabled v0.0.0-20191218021247-9c176d4a652d.

[linzhp]

the fact that the version is changed is due to the existing requirement on github.com/linzhp/go_examples/modEnabled v0.0.0-20191218021247-9c176d4a652d, which does indeed require v2.2.3+incompatible

Sorry, I don't understand. I have both go.mod files of linzhp/go_examples/hyphen and linzhp/go_examples/modEnabled say they require hexonet/go-sdk@v1.2.1, but both @bcmills and @jayconrod think modEnabled requires v2.2.3. Where does that come from?

[bcmills]

Modules are versioned. The version that hyphen requires in its go.mod file is from an older commit, not the same commit in the repository.

[linzhp]

But my point is linzhp/go_examples/modEnabled requires hexonet/go-sdk@v1.2.1 in its go.mod file. Why Go mod doesn't honor this requirement?

[bcmills]

@linzhp, github.com/linzhp/go_examples/modEnabled at commit 9c176d4a652d requires github.com/hexonet/go-sdk v2.2.3+incompatible.

github.com/linzhp/go_examples/hyphen requires github.com/linzhp/go_examples/modEnabled at commit 9c176d4a652d.

It does not matter what the go.mod file in other commits says, because those other commits are not relevant to the build for github.com/linzhp/go_examples/hyphen.

[linzhp]

Oh, I see. Thanks for the explanation.