cmd/go: 'mod tidy' sometimes adds new, unnecessary require sections

[cespare]

Go version

go version go1.22.3 linux/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN='/home/caleb/bin'
GOCACHE='/home/caleb/.cache/go-build'
GOENV='/home/caleb/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/caleb/p/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/caleb/p/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/caleb/apps/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/caleb/apps/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.3'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/caleb/3p/pomerium/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4079397003=/tmp/go-build -gno-record-gcc-switches'

What did you do?

This is spun off of #56471. That proposal suggests having go mod tidy automatically join multiple require sections. However, there's an underlying bug where go mod tidy itself is often responsible for these multiple sections. This issue is about the bug.

---

On a large private Go module at work, we have three require sections. These were all created by go mod tidy. The first one has direct dependencies and the second and third require sections have indirect dependencies.

We can reproduce the error easily: if we delete the second require section (the first of the two indirect sections) and then run go mod tidy, it recreates the separate indirect require section rather than adding the missing entries to the existing require section.

I cannot share the work code, but by looking through issues linked to #56471, I located a public repo where the same issue occurred. Here's how to reproduce the issue using that repo:

$ git clone https://github.com/pomerium/pomerium
...
$ cd pomerium
$ git checkout -q f54b1a7d098fac76c7ddbccdb9351483466b7b6a
# Observe that the go.mod contains three sections.
# Delete the second section.
$ sed -i '78,123d' go.mod
# Now go.mod contains two sections, direct and indirect.
$ go mod tidy
...
# Observe that go.mod contains three sections again.
# 'go mod tidy' added a section.

What did you see happen?

go mod tidy added a new extra indirect require section.

What did you expect to see?

I would expect go mod tidy to add entries to the existing require section.

More generally: if I only ever edit go.mod automatically, never by hand, I would expect the Go tool to maintain at most two require sections (one direct and one indirect).

Note that it is somewhat possible to work around the issue. If you manually join the two require sections, go mod tidy will keep them together as one large section (it won't split them up). But this manual work shouldn't be required. Also, it's only temporary: future additions to the code may cause go mod tidy to add new sections to go.mod.

[cespare]

/cc @matloob @samthanawalla per owners

[gabyhelp]

Similar Issues

• cmd/go: mod tidy should join "require" sections if there are more than two #56471
• cmd/go: mod tidy -go=1.17 should move indirect dependencies to the second require part #47733
• cmd/go: go mod tidy updates a dependency unnecessarily #33771
• cmd/go: document why go mod tidy adds entries beyond those added by go build #27633
• cmd/go: 'mod tidy' chooses points in requirement cycles that differ from other subcommands #34086

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[thediveo]

I can probably offer another example: https://github.com/siemens/turtlefinder/blob/f21b66938827bb8d9ec1a720b34c870465e5620e/go.mod

The third require section in this case has even a mix of direct and indirect if I understand it correctly.