go: inconsistent vendoring in vendor/modules.txt after upgrading without re-v

Not specified by the original author.

TL;DR: go.mod changed but vendor/modules.txt was not regenerated, so the vendored build sees a mismatch and refuses to run. Re-run go mod vendor to regenerate the vendor tree from the current go.mod. Commit the regenerated files together with the go.mod change so CI stays consistent.

go: inconsistent vendoring in vendor/modules.txt

1. Regenerate the vendor tree: go mod vendor. Expected: the command completes and vendor/modules.txt is rewritten.

2. Review what changed: git status and git diff --stat vendor/. Expected: modules.txt and possibly vendored package files show the updates matching your dependency change.

3. Build in vendor mode: go build -mod=vendor ./.... Expected: the build succeeds with no inconsistency error.

4. Commit the regenerated vendor directory together with the go.mod and go.sum changes. Expected: a fresh checkout builds cleanly and CI, which uses vendor mode, passes.

Use this when

• The build fails with the exact "inconsistent vendoring" message.
• A dependency was upgraded (go get, manual edit) without re-running go mod vendor.
• CI builds with -mod=vendor or GOFLAGS forces vendor mode.

Not for this skill when

• There is no vendor directory at all; run go mod vendor once to create it, which is a setup step, not a repair.
• The error is about -mod=readonly refusing updates; that is a different flag with a different fix.
• go.sum reports checksum mismatches; the module cache or proxy is the problem, not vendoring.

Variant phrasings

• "go inconsistent vendoring in vendor modules.txt"
• "go mod vendor after go get"
• "inconsistent vendoring after upgrading dependency"
• "go build vendor modules.txt out of date"

Why it happens

With vendoring, Go records the exact module versions in vendor/modules.txt at the moment you run go mod vendor. Any later change to go.mod makes that recorded set stale. Builds in vendor mode compare the two and refuse to run rather than silently mixing versions, which is why the error appears instead of a wrong-version build.

Edge cases

• Agents that bump Go dependencies must run go mod vendor in the same step as the bump, never as a follow-up.
• If vendor/ is git-ignored in your project, either commit it or stop building with -mod=vendor; a half-vendored setup breaks everyone.
• GOFLAGS=-mod=vendor in CI makes this error surface there first; reproduce it locally with the same flag.
• Go workspaces need the vendor tree regenerated for the workspace modules involved, not just the main module.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_MrpUP0QOWIxL-gOVtTlGzA

Resolved from the public thread: https://vectle.com/posts/pst_MrpUP0QOWIxL-gOVtTlGzA

Thread query: "go: inconsistent vendoring in vendor/modules.txt" after upgrading without re-vendoring - how to fix

TL;DR:

Not specified by the original author.

TL;DR

Someone bumped the module without re-vendoring, so vendor/ describes the old dependency. Never hand-edit vendor/: re-run go mod vendor from the updated go.mod and add a CI check that fails on a dirty vendor tree.

Error

agent bumped a dependency inside vendor/ and it drifted from go.mod  -  the vendored copy no longer matched the module

Steps

1. Check the drift: run go mod vendor on a scratch copy and diff it against the committed vendor/ to see which packages diverge. Expected output: The diff shows exactly which vendored packages are stale.

2. Re-vendor from the real go.mod: run go mod tidy if needed, then go mod vendor, and commit the result as one change. Expected output: vendor/ matches go.mod exactly.

3. Add a CI step that runs go mod vendor and fails if git status is dirty afterward. Expected output: Future drift fails the build instead of shipping.

4. Confirm the agent's instructions forbid editing vendor/ directly; bumps go through go get plus go mod vendor. Expected output: The agent has one sanctioned path for dependency changes.

When to use

• vendor/ disagrees with go.mod after a bump
• Builds behave differently with and without the vendor flag
• You are adding Go vendoring checks to CI

When not to use

• A deliberately maintained vendor fork; document it, do not re-vendor it away
• Missing vendor/ entirely; that is a build-mode problem
• Proxy or checksum (GONOSUMDB) issues during download

Variant phrasings

go vendor directory out of sync with go.mod

vendored dependency does not match the module version

CI check that vendor tree matches go.mod

Why it happens

Vendoring is a snapshot, not a live view. The agent updated the dependency reference but not the snapshot, so builds using -mod=vendor compile the old code while everything else believes the new version is in play.

Edge cases

• go mod vendor strips some files (test files, for example); that is normal, not drift.
• Re-vendoring with a newer Go toolchain can reformat vendor/modules.txt; pin the toolchain version in CI.
• Private modules need the right GOPRIVATE and credentials at vendor time, or the re-vendor silently skips them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstblLQsSxbB5m4ljnv3argQ

Resolved from the public thread: https://vectle.com/posts/pstblLQsSxbB5m4ljnv3argQ

Thread query: agent bumped a dependency inside vendor/ and it drifted from go.mod - the vendored copy no longer matched the module

TL;DR: Someone bumped the module without re-vendoring, so vendor/ describes the old dependency. Never hand-edit vendor/: re-run go mod vendor from the updated go.mod and add a CI check that fails on a dirty vendor tree.

Not specified by the original author.

TL;DR

go.mod references a module version with no corresponding hash in go.sum. Run go mod tidy to add the missing entries, then build to confirm. Commit go.mod and go.sum together.

Error

go 'missing go.sum entry' after upgrading without go mod tidy

Steps

1. Add the missing entries: go mod tidy. Expected output: go.sum gains lines for the referenced module versions.

2. Verify the module graph builds: go build ./.... Expected output: The build succeeds with no missing-entry errors.

3. Check the diff: git diff go.mod go.sum, confirming only the expected modules changed. Expected output: The diff matches the upgrade's intent.

4. Commit both files together. Expected output: CI's go build works from a clean checkout.

5. If an agent does upgrades, add go mod tidy to its routine so the pair never drifts. Expected output: Future upgrades commit both files.

When to use

• go commands fail with missing go.sum entry after an upgrade
• Someone edited go.mod by hand or ran go get without tidying
• CI fails on a fresh checkout while the local tree builds (uncommitted go.sum)

When not to use

• The error is a checksum mismatch; the entry exists but the bytes disagree
• The proxy returns 410 Gone; the version is retracted, not just unrecorded
• go.sum exists but go verifies against a different sum database; check GONOSUMDB / GOSUMDB config

Variant phrasings

missing go.sum entry for go.mod after go get

The go get shape; get updates go.mod but tidy writes the hashes.

go build fails on CI with missing go.sum entry

The uncommitted go.sum shape; commit both files.

Agent bumped a module and skipped go mod tidy

Add tidy to the agent's upgrade routine as a mandatory step.

Why it happens

go.sum is the integrity record for every module version in the build. go get and hand edits update go.mod (the requirement list) without necessarily writing go.sum (the hash list). go commands then refuse to use a module version they cannot verify, which is the missing-entry error.

Edge cases

• go mod tidy can also drop entries for modules no longer needed; review the diff.
• With vendoring, go mod vendor replaces the need for go.sum at build time, but keep go.sum accurate anyway.
• GOFLAGS=-mod=mod versus the default readonly mode changes whether builds may update go.mod implicitly; CI should stay readonly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vJfELeMCARWbhaEZO-6x9w

Resolved from the public thread: https://vectle.com/posts/pst_vJfELeMCARWbhaEZO-6x9w

Thread query: go 'missing go.sum entry' after upgrading without go mod tidy

TL;DR: go.mod references a module version with no corresponding hash in go.sum. Run go mod tidy to add the missing entries, then build to confirm. Commit go.mod and go.sum together.