cmd/go: 'go mod why -m' gives false negative in inconsistent, pruned module

[jayconrod]

What version of Go are you using (go version)?

$ go version
go version go1.17.1 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/jay/.cache/go-build"
GOENV="/home/jay/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/jay/.cache/gomodcache"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/jay/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/opt/go/go1.17.1"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/opt/go/go1.17.1/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.1"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/jay/Code/test/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3259942741=/tmp/go-build -gno-record-gcc-switches"

What did you do?

In a tidy pruned module (with go 1.17 or higher in go.mod), edit an indirect dependency down to a lower version without changing direct dependencies that require it. This makes go.mod inconsistent: go list -m all will show an error, and go -list -m -mod=mod all will show the original build list and will fix go.mod.

In this state, go mod why -m falsely reports that the main module does not depend on the downgraded module.

# This command works correctly.
go mod why -m rsc.io/sampler

# Downgrade indirect dependency without changing direct dependent.
go mod edit -require=rsc.io/sampler@v1.2.0

# This command says nothing uses rsc.io/sampler
go mod why -m rsc.io/sampler

-- go.mod --
module use

go 1.17

require rsc.io/quote v1.5.2

require (
        golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c // indirect
        rsc.io/sampler v1.3.0 // indirect
)
-- go.sum --
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c h1:qgOY6WgZOaTkIIMiVjBQcw93ERBE4m30iBm00nkL0i8=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
rsc.io/quote v1.5.2 h1:w5fcysjrx7yqtD/aO+QwRjYZOKnaM9Uh2b40tElTs3Y=
rsc.io/quote v1.5.2/go.mod h1:LzX7hefJvL54yjefDEDHNONDjII0t9xZLPXsUe+TKr0=
rsc.io/sampler v1.3.0 h1:7uVkIFmeBqHfdjD+gZwtXXI+RODJ2Wc4O7MPEh/QiW4=
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-- use.go --
package use

import _ "rsc.io/quote"

What did you expect to see?

go mod why -m rsc.io/sampler should report the correct import chain in either case.

What did you see instead?

# rsc.io/sampler
(main module does not need module rsc.io/sampler)

[gopherbot]

Change https://golang.org/cl/352115 mentions this issue: cmd/go: make 'go mod why -m' work in inconsistent, pruned module