go module_error ai_generated true

go: updates to go.sum needed, disabled by -mod=readonly; to update run: go mod tidy

ID: go/mod-tidy-missing-go-sum

Also available as: JSON · Markdown
92%Fix Rate
92%Confidence
120Evidence
2021-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
122 active — — —

Root Cause

The go.sum file is missing entries needed for the current dependencies. Go modules require go.sum to verify dependency integrity. Running go mod tidy updates both go.mod and go.sum.

generic

Workarounds

  1. 95% success Run go mod tidy to update go.mod and go.sum 
    go mod tidy
# This adds missing entries and removes unused ones from go.sum
# Commit both go.mod and go.sum

    Sources: https://go.dev/ref/mod#go-mod-tidy

  2. 90% success In CI, ensure go.sum is committed and up-to-date 
    # Add to CI pipeline:
go mod tidy
git diff --exit-code go.mod go.sum
# This fails the build if go.sum is out of date

    Sources: https://go.dev/ref/mod#go-mod-tidy

Dead Ends

Common approaches that don't work:

  1. Deleting go.sum and regenerating from scratch 55% fail

    While this works in isolation, it changes checksums for all dependencies, making the diff noisy and potentially introducing different versions than intended.

  2. Using GONOSUMCHECK to skip checksum verification 75% fail

    Disables security verification of downloaded modules. Supply chain attacks become possible. Not a fix, just hiding the problem.

Error Chain

Frequently confused with: