Why is foo in my go.sum file?

[Nigel Tao]

The go.sum file in the golang.org/x/image repo has a line that is not
another golang.org.x/* module:

github.com/yuin/goldmark v1.4.13/go.mod
h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

https://github.com/golang/image/blob/2b687b56714d59d061135c735913a64fe2b70778/go.sum#L1

That line was added in a go...@golang.org authored commit last October:
https://github.com/golang/image/commit/ffcb3fe7d1bf4ed2e01a95a552bb3b7f5dab24d1

I'm just curious why goldmark is considered a dependency. "go mod why"
and plain old "grep" doesn't give me any leads.

---
$ git checkout ffcb3fe7d1bf4ed2e01a95a552bb3b7f5dab24d1
HEAD is now at ffcb3fe go.mod: update golang.org/x dependencies

$ go mod why github.com/yuin/goldmark
# github.com/yuin/goldmark
(main module does not need package github.com/yuin/goldmark)

$ grep goldmark -R .
./go.sum:github.com/yuin/goldmark v1.4.13/go.mod
h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
---

Am I holding "go mod why" wrong? What else can I try?

[Dan Kortschak]

My guess is the go.mod in x/tools.

https://github.com/golang/tools/blob/master/go.mod

[TheDiveO]

test case?