cmd/go: "mod why" does not use results of fetch-updated dependency graph

[myitcv]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.11.1 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/home/gopher/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/gopher/gopath"
GOPROXY=""
GORACE=""
GOROOT="/go"
GOTMPDIR=""
GOTOOLDIR="/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build128631987=/tmp/go-build -gno-record-gcc-switches"

What did you do?

$ git clone https://github.com/aws/aws-sdk-go /tmp/aws-sdk-go
Cloning into '/tmp/aws-sdk-go'...
$ cd /tmp/aws-sdk-go
$ git checkout 027c0bda560ef6bae8e84a3fd91d9863129329a7
HEAD is now at 027c0bda... Merge pull request #2226 from aws/release

We can see the committed go.mod and go.sum are not current:

$ go mod tidy
go: finding github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8
go: downloading github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8
go: finding github.com/gucumber/gucumber latest
...
$ git diff
diff --git a/go.mod b/go.mod
index 7a1bd6e9..3e5d1ed0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,5 +1,15 @@
 module github.com/aws/aws-sdk-go

 require (
+       github.com/davecgh/go-spew v1.1.1 // indirect
+       github.com/go-sql-driver/mysql v1.4.0
+       github.com/gucumber/gucumber v0.0.0-20180127021336-7d5c79e832a2
        github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8
+       github.com/pkg/errors v0.8.0
+       github.com/pmezard/go-difflib v1.0.0 // indirect
+       github.com/shiena/ansicolor v0.0.0-20151119151921-a422bbe96644 // indirect
+       github.com/stretchr/testify v1.2.2
+       golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519
+       golang.org/x/tools v0.0.0-20181023010539-40a48ad93fbe
+       google.golang.org/appengine v1.2.0 // indirect
 )
...

Revert to the committed version:

$ git checkout .

Now run a go mod why -m query:

$ go mod why -m github.com/davecgh/go-spew
go: finding golang.org/x/net/html latest
go: finding golang.org/x/net/http2 latest
...
# github.com/davecgh/go-spew
(main module does not need module github.com/davecgh/go-spew)

However, this is in the dependency graph, as is confirmed by running the same query again:

$ go mod why -m github.com/davecgh/go-spew
# github.com/davecgh/go-spew
github.com/aws/aws-sdk-go/aws/credentials
github.com/aws/aws-sdk-go/aws/credentials.test
github.com/stretchr/testify/assert
github.com/davecgh/go-spew/spew

What did you expect to see?

The query to succeed first time around:

$ go mod why -m github.com/davecgh/go-spew
go: finding golang.org/x/net/html latest
go: finding golang.org/x/net/http2 latest
...
# github.com/davecgh/go-spew
github.com/aws/aws-sdk-go/aws/credentials
github.com/aws/aws-sdk-go/aws/credentials.test
github.com/stretchr/testify/assert
github.com/davecgh/go-spew/spew

What did you see instead?

$ go mod why -m github.com/davecgh/go-spew
go: finding golang.org/x/net/html latest
go: finding golang.org/x/net/http2 latest
...
# github.com/davecgh/go-spew
(main module does not need module github.com/davecgh/go-spew)

[bcmills]

go mod why -m probably shouldn't update the go.mod file at all. (Perhaps it should fail if the import graph has unresolved requirements.)

[bcmills]

go mod why -m probably shouldn't update the go.mod file at all.

That's #26977, so closing as a duplicate.