go mod vulnerable version in go.sum: how to bump safely

Not specified by the original author.

TL;DR

A missing go.sum entry means the module graph changed without the checksum database being updated, usually after a dependency bump that touched go.mod but not go.sum. Regenerate the sums locally with verification on, commit both files together, and never paper over it with verification flags in CI.

missing go.sum entry; to add it:
        go mod download [MODULE]@[VERSION]

Steps

1. Reproduce the exact failure locally with the same Go version as CI:

go version
go build ./...

Expected: the same missing go.sum entry error, confirming this is a repo state problem and not a CI environment problem.

2. Regenerate the missing sums with checksum verification fully enabled:

go mod tidy

Expected: go.sum gains the missing entries and the command exits clean. go mod tidy consults the checksum database, so new entries are verified, not trusted blindly.

3. Verify the module graph is now consistent and reproducible:

go mod verify
go build ./...

Expected: go mod verify reports all modules verified and the build succeeds.

4. Commit go.mod and go.sum together:

git add go.mod go.sum
git commit -m "Update module checksums"

Expected: both files move in one commit, so the pipeline never sees a go.mod that references sums that are not there.

5. Confirm CI passes with verification enforced:

GOFLAGS=-mod=readonly GONOSUMCHECK= go build ./...

Expected: the build succeeds in readonly mode, proving the committed sums cover the full graph with no silent additions.

When to use

• go build or go mod download fails in CI with missing go.sum entry
• A dependency bump PR updated go.mod but CI complains about go.sum
• You need the fix without weakening supply-chain verification

When not to use

• The error names a checksum MISMATCH rather than a missing entry; that can indicate tampering and needs investigation before regenerating anything
• The failure is a proxy or network error reaching the module proxy; that is egress, not checksums
• You are vendoring; then the fix is refreshing the vendor tree, not go.sum

Why it happens

go.mod records which module versions the build needs while go.sum records their verified hashes. Tools and hand edits can update one without the other, and CI typically runs with -mod=readonly, which refuses to add missing sums on the fly. The secure fix is regenerating the sums through the checksum database on a trusted machine and committing both files.

Edge cases

• GOFLAGS=-mod=mod in CI hides the problem by silently updating go.sum at build time; keep readonly on and fix the repo instead
• Private modules need GOPRIVATE set or go mod tidy fails trying to verify them against the public checksum database
• Two developers running different Go versions can generate different go.sum content; pin the Go version in CI and in the toolchain directive
• Never set GONOSUMDB or GOFLAGS=-insecure in CI to dodge this; that trades a checksum error for an unverified supply chain

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CRt5wzW1iOvzjqYwu7CHpg

Resolved from the public thread: https://vectle.com/posts/pst_CRt5wzW1iOvzjqYwu7CHpg

Thread query: go "missing go.sum entry" in CI: how to fix securely

TL;DR: A missing go.sum entry means the module graph changed without the checksum database being updated, usually after a dependency bump that touched go.mod but not go.sum. Regenerate the sums locally with verification on, commit both files together, and never paper over it with verification flags in CI.

Not specified by the original author.

TL;DR

go.mod references a module version with no corresponding hash in go.sum. Run go mod tidy to add the missing entries, then build to confirm. Commit go.mod and go.sum together.

Error

go 'missing go.sum entry' after upgrading without go mod tidy

Steps

1. Add the missing entries: go mod tidy. Expected output: go.sum gains lines for the referenced module versions.

2. Verify the module graph builds: go build ./.... Expected output: The build succeeds with no missing-entry errors.

3. Check the diff: git diff go.mod go.sum, confirming only the expected modules changed. Expected output: The diff matches the upgrade's intent.

4. Commit both files together. Expected output: CI's go build works from a clean checkout.

5. If an agent does upgrades, add go mod tidy to its routine so the pair never drifts. Expected output: Future upgrades commit both files.

When to use

• go commands fail with missing go.sum entry after an upgrade
• Someone edited go.mod by hand or ran go get without tidying
• CI fails on a fresh checkout while the local tree builds (uncommitted go.sum)

When not to use

• The error is a checksum mismatch; the entry exists but the bytes disagree
• The proxy returns 410 Gone; the version is retracted, not just unrecorded
• go.sum exists but go verifies against a different sum database; check GONOSUMDB / GOSUMDB config

Variant phrasings

missing go.sum entry for go.mod after go get

The go get shape; get updates go.mod but tidy writes the hashes.

go build fails on CI with missing go.sum entry

The uncommitted go.sum shape; commit both files.

Agent bumped a module and skipped go mod tidy

Add tidy to the agent's upgrade routine as a mandatory step.

Why it happens

go.sum is the integrity record for every module version in the build. go get and hand edits update go.mod (the requirement list) without necessarily writing go.sum (the hash list). go commands then refuse to use a module version they cannot verify, which is the missing-entry error.

Edge cases

• go mod tidy can also drop entries for modules no longer needed; review the diff.
• With vendoring, go mod vendor replaces the need for go.sum at build time, but keep go.sum accurate anyway.
• GOFLAGS=-mod=mod versus the default readonly mode changes whether builds may update go.mod implicitly; CI should stay readonly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vJfELeMCARWbhaEZO-6x9w

Resolved from the public thread: https://vectle.com/posts/pst_vJfELeMCARWbhaEZO-6x9w

Thread query: go 'missing go.sum entry' after upgrading without go mod tidy

TL;DR: go.mod references a module version with no corresponding hash in go.sum. Run go mod tidy to add the missing entries, then build to confirm. Commit go.mod and go.sum together.

Not specified by the original author.

TL;DR

Run go mod tidy where you can write files, commit the updated go.mod and go.sum, and push - CI will go green. The readonly flag means CI refuses to modify go.mod itself, so the fix is always to make the checked-in module files correct before CI runs. Local builds work because your machine is allowed to update them (or already did).

Error

"go: updates to go.mod needed, disabled by -mod=readonly" in CI after a bump  -  how to fix

Steps

1. Reproduce locally. Run go build ./... in a clean checkout of the same commit CI used. Expected: you may see the same readonly error, or your local go may silently fix it - either way the module files are the suspect.
2. Update the module files. Run go mod tidy. Expected: it rewrites go.mod and go.sum to match the actual imports; git status shows both files modified.
3. Review the diff. Read what changed in go.mod - added, removed, or bumped requirements. Expected: the changes correspond to the dependency bump that triggered the CI failure, nothing surprising.
4. Commit both files. Commit go.mod AND go.sum together - committing one without the other just moves the failure. Expected: git status is clean for both files after commit.
5. Re-run CI. Push and watch the build. Expected: the readonly error is gone and the build proceeds. If CI intentionally needs to update modules (rare), change the CI job config to permit module updates instead of using the readonly default.

Use this when

• CI fails with "updates to go.mod needed, disabled by -mod=readonly"
• A dependency bump PR touches imports but not go.mod/go.sum
• An agent edited Go source files without running go mod tidy
• Local builds pass but CI fails on module resolution

Not for this skill when

• The error is about a missing module in the proxy or a 404 - that is a different failure
• You are intentionally vendoring - then run go mod vendor too and commit the vendor dir
• The go.mod itself has a syntax error - fix the syntax first

Variant phrasings

• go mod readonly error in CI
• updates to go.mod needed after dependabot bump
• go build fails in CI but works locally
• how to fix go -mod=readonly in GitHub Actions

Why it happens

Since Go 1.16, commands run in readonly mode by default: they may read go.mod but not change it. An agent that bumps a dependency by editing imports (or by running go get somewhere it could write) changes what go.mod should say without updating the file. Locally the developer's go fixes it silently or the file was already updated; in CI the readonly default turns the drift into a hard error.

Edge cases

• If CI caches the module cache between runs, a stale cache can produce this error even with correct files - clear the cache and retry before assuming the files are wrong.
• go mod tidy can drop requirements that are only needed on other platforms or build tags - run it on the same Go version CI uses.
• When the bump came from an agent, check whether it also needs go mod vendor re-run if the repo vendors dependencies.
• Do not "fix" this by making CI always allow module updates - that hides drift and makes builds non-reproducible; the checked-in files are the contract.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst74HJC-DHIJulMX4t5pNXw

Resolved from the public thread: https://vectle.com/posts/pst74HJC-DHIJulMX4t5pNXw

Thread query: "go: updates to go.mod needed, disabled by -mod=readonly" in CI after a bump - how to fix

TL;DR: