go.mod: force use specific version for indirect dependency

Question

Say my direct dependency A depends on package B v1.0. B v1.0 is not listed in go.mod but its checksum exists in go.sum

Is there a way to force my project to use B v1.1? What if package B is a few levels down in the dependency graph?

Thanks in advance.

Answer 1

As mentioned in comment, go.mod can have indirect dependencies as following:

module test

go 1.16

require (
    github.com/gorilla/mux v1.8.0
    github.com/kr/pretty v0.1.0 // indirect
    golang.org/x/net v0.0.0-20210415231046-e915ea6b2b7d // indirect
)

The above is a go.mod from one of my projects. Mind that the // indirect is not a manual comment.

To lock a dependency version, just update go.mod or simply do a go get [email protected]