How to identify dependency chain using Go Modules

Question

How can I identify the import path of a module that exists in go.sum but not in go.mod? I'd like to know which module in go.mod is importing the module listed in go.sum, and the entire chain between them.

I'm in the process of removing a deprecated module, logrus, from one of my modules and my own dependencies and want to ensure none of my own code still uses it, and which other code does use it.

The Go module has both a go.mod and a go.sum file. In the go.sum file, a module github.com/sirupsen/logrus appears that does not appear in the go.mod file.

When I recreate the go.sum file by deleting go.sum and running go test -v ./..., the go.sum file is recreated with logrus.

There is no direct or indirect mention in go.mod, such as:

github.com/sirupsen/logrus v1.6.0 // indirect

go mod why returns the following:

$ go mod why github.com/sirupsen/logrus
# github.com/sirupsen/logrus
(main module does not need package github.com/sirupsen/logrus)

go mod why -m returns the following:

$ go mod why -m github.com/sirupsen/logrus
# github.com/sirupsen/logrus
(main module does not need module github.com/sirupsen/logrus)

How can I find out what module in go.mod is importing a module, logrus, which is listed in go.sum but not go.mod?

Here's the module:

• Module: https://github.com/grokify/goauth
• go.mod
• go.sum

Tinstone

Try running with the -m switch: go mod why -m github.com/sirupsen/logrus – Lubber

That returned (main module does not need module github.com/sirupsen/logrus) which I've also added to the question. Thanks. – Tinstone

Answer 1

go mod why github.com/sirupsen/logrus
# or 
go mod graph | grep logrus

Porcelain

This returns (main module does not need package github.com/sirupsen/logrus). I've added this to the question for the module. Does this need to be explicitly run against each module? – Tinstone

This is indirect dep, but you still can find what is using it. pelse see update. – Porcelain

go mod graph | grep logrus worked. Thanks! – Tinstone

indirect deps not always shown, only if go.mod missing for imported module, its deps will be in go.mod. – Porcelain

Very good info! I had noted // indirect deps in go.mod but that wasn't listed either. I've added this to the question to make it more useful. I was able to learn which modules use the module and it isn't my own code. – Tinstone