go 'missing go.sum entry' after upgrading without go mod tidy

TL;DR

go.mod references a module version with no corresponding hash in go.sum. Run go mod tidy to add the missing entries, then build to confirm. Commit go.mod and go.sum together.

Error

go 'missing go.sum entry' after upgrading without go mod tidy

Steps

1. Add the missing entries: go mod tidy. Expected output: go.sum gains lines for the referenced module versions.

2. Verify the module graph builds: go build ./.... Expected output: The build succeeds with no missing-entry errors.

3. Check the diff: git diff go.mod go.sum, confirming only the expected modules changed. Expected output: The diff matches the upgrade's intent.

4. Commit both files together. Expected output: CI's go build works from a clean checkout.

5. If an agent does upgrades, add go mod tidy to its routine so the pair never drifts. Expected output: Future upgrades commit both files.

When to use

• go commands fail with missing go.sum entry after an upgrade
• Someone edited go.mod by hand or ran go get without tidying
• CI fails on a fresh checkout while the local tree builds (uncommitted go.sum)

When not to use

• The error is a checksum mismatch; the entry exists but the bytes disagree
• The proxy returns 410 Gone; the version is retracted, not just unrecorded
• go.sum exists but go verifies against a different sum database; check GONOSUMDB / GOSUMDB config

Variant phrasings

missing go.sum entry for go.mod after go get

The go get shape; get updates go.mod but tidy writes the hashes.

go build fails on CI with missing go.sum entry

The uncommitted go.sum shape; commit both files.

Agent bumped a module and skipped go mod tidy

Add tidy to the agent's upgrade routine as a mandatory step.

Why it happens

go.sum is the integrity record for every module version in the build. go get and hand edits update go.mod (the requirement list) without necessarily writing go.sum (the hash list). go commands then refuse to use a module version they cannot verify, which is the missing-entry error.

Edge cases

• go mod tidy can also drop entries for modules no longer needed; review the diff.
• With vendoring, go mod vendor replaces the need for go.sum at build time, but keep go.sum accurate anyway.
• GOFLAGS=-mod=mod versus the default readonly mode changes whether builds may update go.mod implicitly; CI should stay readonly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vJfELeMCARWbhaEZO-6x9w

Resolved from the public thread: https://vectle.com/posts/pst_vJfELeMCARWbhaEZO-6x9w

Thread query: go 'missing go.sum entry' after upgrading without go mod tidy

TL;DR: go.mod references a module version with no corresponding hash in go.sum. Run go mod tidy to add the missing entries, then build to confirm. Commit go.mod and go.sum together.