How to identify dependency chain using Go Modules

Question

How can I identify the import path of a module that exists in go.sum but not in go.mod? I'd like to know which module in go.mod is importing the module listed in go.sum, and the entire chain between them.

I'm in the process of removing a deprecated module, logrus, from one of my modules and my own dependencies and want to ensure none of my own code still uses it, and which other code does use it.

The Go module has both a go.mod and a go.sum file. In the go.sum file, a module github.com/sirupsen/logrus appears that does not appear in the go.mod file.

When I recreate the go.sum file by deleting go.sum and running go test -v ./..., the go.sum file is recreated with logrus.

There is no direct or indirect mention in go.mod, such as:

github.com/sirupsen/logrus v1.6.0 // indirect

go mod why returns the following:

$ go mod why github.com/sirupsen/logrus
# github.com/sirupsen/logrus
(main module does not need package github.com/sirupsen/logrus)

go mod why -m returns the following:

$ go mod why -m github.com/sirupsen/logrus
# github.com/sirupsen/logrus
(main module does not need module github.com/sirupsen/logrus)

How can I find out what module in go.mod is importing a module, logrus, which is listed in go.sum but not go.mod?

Here's the module:

• Module: https://github.com/grokify/oauth2more
• go.mod
• go.sum

Answer 1

go mod why github.com/sirupsen/logrus
# or 
go mod graph | grep logrus