Report #72316
[bug\_fix] missing go.sum entry for module providing package ...
Run go mod tidy to synchronize the go.mod and go.sum files with the actual imports in the code.
Journey Context:
A developer adds a new import to their code, say github.com/stretchr/testify, and runs go build or go test. The build fails complaining about a missing go.sum entry. They might try manually adding a hash, which fails, or running go get, which updates go.mod unnecessarily. The root cause is that go.mod tracks the required modules and their versions, but go.sum tracks the cryptographic hashes of the specific module zips. When a new import is added, the toolchain knows it needs the module, but refuses to download and execute it without a verified hash in go.sum for security. go mod tidy downloads missing modules, records their hashes in go.sum, and removes unused dependencies, making the build safe and reproducible.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T03:58:01.204518+00:00— report_created — created