modules and indirect

[Jérôme LAFORGE]

Hello Gophers,

In view of this this commit https://github.com/go-kit/kit/commit/362dd5cb62daf3def58ab021538cee272164dd26 (I have noted the same on my internal projects), I am surprised that go mod tidy doesn't remove all unnecessary dependencies from the go.mod.

It raises some questions:

- Is it unsafe to do this kind of process to ensure that all unnecessary dependencies are removed?

- Why go mod tidy doesn't remove them?

- How it can be done with go tools?

Thx in adv

Regards,

Jérôme

[Jérôme LAFORGE]

Hello,

in addition to my previous message, this how to reproduce this problem with mogodb driver (as go-kit has errors while updating its modules with go get -u ./...):

$ git clone https://github.com/mongodb/mongo-go-driver.git

$ git checkout 6d539cd5b1ab1700e04cb39f134a408c39b7d2d5

$ go get -u ./...

$ go mod tidy

$ git commit -am "gauge"

$ sed -i "/\/\/ indirect$/d" go.mod

$ go mod tidy

$ git diff go.mod

diff --git a/go.mod b/go.mod

index 81480e36..221eced8 100644

--- a/go.mod

+++ b/go.mod

@@ -8,21 +8,16 @@ require (

        github.com/gobuffalo/packr/v2 v2.8.0

        github.com/golang/snappy v0.0.1

        github.com/google/go-cmp v0.4.0

-       github.com/karrick/godirwalk v1.15.6 // indirect

        github.com/klauspost/compress v1.10.4

        github.com/kr/pretty v0.2.0

-       github.com/kr/text v0.2.0 // indirect

        github.com/montanaflynn/stats v0.6.3

        github.com/pelletier/go-toml v1.7.0

        github.com/pkg/errors v0.9.1

-       github.com/sirupsen/logrus v1.5.0 // indirect

        github.com/stretchr/testify v1.5.1

        github.com/tidwall/pretty v1.0.0

        github.com/xdg/scram v0.0.0-20180814205039-7eeb5667e42c

        github.com/xdg/stringprep v0.0.0-20180714160509-73f8eece6fdc

        golang.org/x/crypto v0.0.0-20200406173513-056763e48d71

        golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a

-       golang.org/x/sys v0.0.0-20200409092240-59c9f1ba88fa // indirect

-       golang.org/x/text v0.3.2 // indirect

        golang.org/x/tools v0.0.0-20200410194907-79a7a3126eef

 )

Regards,

Jérôme

[Nick]

Quoth Jérôme LAFORGE:

> I am surprised that go mod tidy doesn't remove all unnecessary
> dependencies from the go.mod.
>
> It raises some questions:
> - Is it unsafe to do this kind of process to ensure that all unnecessary
> dependencies are removed?
> - Why go mod tidy doesn't remove them?
> - How it can be done with go tools?

I have also been surprised by this behaviour. I'd be keen to hear
rationale for it, as I (no doubt naively) can't imagine why it isn't
always the correct decision to remove all unneeded dependencies in
go.mod when 'go mod tidy' is run. Indeed, I'd say that the name
'tidy' implies "remove unneeded stuff" more than "add needed stuff".