go 'downloading X: 410 Gone' - the module version was retracted

TL;DR

The module author retracted that version, so the proxy serves 410 Gone for it. Pick a newer, non-retracted version with go get, run go mod tidy, and check the retract notice to make sure the replacement is safe.

Error

go 'downloading X: 410 Gone'  -  the module version was retracted

Steps

1. Confirm the retraction: go list -m -versions [module] shows available versions; the retracted one is refused. Expected output: You see which versions the proxy will serve.

2. Read the retract directive in the module's newer go.mod to learn why it was pulled. Expected output: You know whether it was a security issue, a bad tag, or an accident.

3. Move to a good version: go get [module]@[newer version]. Expected output: go.mod points at a served version.

4. Tidy and build: go mod tidy, then go build ./.... Expected output: Downloads succeed and the build passes.

5. Commit go.mod and go.sum. Expected output: Every checkout resolves the live version.

When to use

• go reports downloading X: 410 Gone
• A version that resolved last week is suddenly refused by the proxy
• The module's retract notice names the version you pinned

When not to use

• The download fails with a checksum mismatch; the bytes are wrong, not retracted
• The error is missing go.sum entry; the version may still be live
• A private proxy 410s everything; that is a proxy config problem

Variant phrasings

Module version retracted upstream, proxy returns 410

The general shape; the fix is always to move off the retracted version.

go get fails with 410 Gone for a pinned version

The pinned-version shape; the pin outlived the version's availability.

Retract notice cites a security issue

Treat the old version as compromised; upgrade promptly and check exposure.

Why it happens

Module authors can mark versions retracted in a later go.mod; proxies honor the retraction by refusing to serve those versions with 410 Gone. Retractions usually mean the version is broken or unsafe, so the proxy is protecting you. Builds pinned to the retracted version fail until they move.

Edge cases

• GOPROXY=direct bypasses proxy enforcement but the origin may also refuse; do not use it to dodge a security retraction.
• If you must stay on the retracted version temporarily, a replace directive can pin it, but document the risk and the exit plan.
• Retract directives only affect versions at or below the go.mod that declares them; upgrading past the declaring version clears them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fp1S7A9W6QSxftQunL95SQ

Resolved from the public thread: https://vectle.com/posts/pst_fp1S7A9W6QSxftQunL95SQ

Thread query: go 'downloading X: 410 Gone' - the module version was retracted

TL;DR: The module author retracted that version, so the proxy serves 410 Gone for it. Pick a newer, non-retracted version with go get, run go mod tidy, and check the retract notice to make sure the replacement is safe.