go mod vendor without updating packages

[Sankar]

Hi,

I have some packages with some versions in my `go.mod` including some indirect dependencies that are needed by some of my direct dependencies. In this, there is a particular version of grpc that I want to use (and not the latest).

I add the specific version of grpc I want by:

go mod edit -require=google.golang.org/gr...@v1.29.1

which correctly updates the `go.mod` file. But when I run the `go mod vendor` next, this grpc line gets deleted and the latest of grpc is fetched again. How do I enforce and vendor a particular version of an indirect dependency ?

[Bryan C. Mills]

Module dependencies are transitive. 'go mod edit' edits the syntax of the go.mod file, but does not ensure that the resulting transitive dependencies are consistent.

To adjust your dependencies, use 'go get -d' instead of 'go mod edit':

go get -d google.golang.org/gr...@v1.29.1

That will downgrade or remove other dependencies as needed so that the requested version is actually what is selected.