go mod tidy includes dependencies of replaced modules

[wallyqs]

What version of Go are you using (go version)?

$ go version
go version go1.16.3 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/secret/Library/Caches/go-build"
GOENV="/secret/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/secret/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/secret"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.16.3"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/secret/src/github.com/wallyqs/nats-go-mod-test/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/4h/4z2f4hd12g3fc7v9n7ny5mxc0000gn/T/go-build3344754081=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Given a go.mod such as the following to be able to work with a forked repo:

go 1.16

require github.com/nats-io/nats.go v1.10.1-0.20210401234754-e0d6a6af9882

replace github.com/nats-io/nats.go => github.com/wallyqs/nats.go v1.11.50

when running go mod tidy it will fetch the dependencies of the upstream module (in require) instead of the ones of the module in replace. If go mod tidy is avoided though, just running go run -mod=mod app.go would correctly fetch the deps from the replaced repo.

What did you expect to see?

Expected to see the result including only dependencies related to the replaced module like this: https://github.com/wallyqs/nats-go-mod-test/blob/main/go.sum

What did you see instead?

The go.mod got changed to include the extra dependencies of the module/repo being replaced instead: https://github.com/wallyqs/nats-go-mod-test/blob/bad-go-mod-tidy/go.mod
https://github.com/wallyqs/nats-go-mod-test/blob/bad-go-mod-tidy/go.sum

Sample app where this can be verified: https://github.com/wallyqs/nats-go-mod-test

Original module: https://github.com/nats-io/nats.go/blob/master/go.mod
Module which should replace original: https://github.com/wallyqs/nats.go/blob/v1.11.50/go.mod

[wallyqs]

Found out that this is due to go mod tidy fetching test dependencies of replaced package.