Is there an existing issue for this?
Package ecosystem
gomod
Package manager version
Go 1.25
Language version
Go 1.25
Manifest location and content before the Dependabot update
Can't provide a link but this is the structure:
Repository has multiple Go modules with replace directives:
/src/training/training-operator/go.mod
/src/inference/inference-model-synthetic/go.mod (has: replace training-operator => ../../training/training-operator)
/src/network/manifold-npm/go.mod
/src/inference/template-deployer/go.mod (has: replace manifold-npm => ../../network/manifold-npm)
dependabot.yml content
version: 2
updates:
- package-ecosystem: "gomod"
directories:
- /src/**/*
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major", "version-update:semver-minor"]
Updated dependency
google.golang.org/grpc from 1.75.1 to 1.79.3 in /src/training/training-operator
google.golang.org/grpc from 1.72.1 to 1.79.3 in /src/network/manifold-npm
What you expected to see, versus what you actually saw
Expected: Dependabot updates go.mod and go.sum in the target module AND runs go mod tidy on sibling modules that reference the target via replace directives, so the PR builds successfully.
Actual: Dependabot only updates go.mod and go.sum in the target module. Sibling modules with replace directives pointing to the target now have stale go.sum files — missing checksums for new transitive dependencies. The build fails with errors like:
go: module-b/go.sum: missing go.sum entry for module providing package X
Native package manager behavior
Running go mod tidy manually in each dependent module after the bump resolves the issue. The native Go toolchain handles this correctly when you run go mod tidy across all affected modules.
Images of the diff or a link to the PR, issue, or logs
The pattern is reproducible in any multi-module Go repo with replace directives.
Smallest manifest that reproduces the issue
repo/
├── module-a/
│ └── go.mod:
│ module example.com/module-a
│ go 1.22
│ require google.golang.org/grpc v1.60.0
│
└── module-b/
└── go.mod:
module example.com/module-b
go 1.22
require example.com/module-a v0.0.0
replace example.com/module-a => ../module-a
When Dependabot bumps grpc in module-a, module-b/go.sum becomes stale because it's missing checksums for grpc's new transitive dependencies.
Is there an existing issue for this?
Package ecosystem
gomod
Package manager version
Go 1.25
Language version
Go 1.25
Manifest location and content before the Dependabot update
Can't provide a link but this is the structure:
Repository has multiple Go modules with replace directives:
/src/training/training-operator/go.mod
/src/inference/inference-model-synthetic/go.mod (has: replace training-operator => ../../training/training-operator)
/src/network/manifold-npm/go.mod
/src/inference/template-deployer/go.mod (has: replace manifold-npm => ../../network/manifold-npm)
dependabot.yml content
version: 2
updates:
directories:
ignore:
update-types: ["version-update:semver-major", "version-update:semver-minor"]
Updated dependency
google.golang.org/grpc from 1.75.1 to 1.79.3 in /src/training/training-operator
google.golang.org/grpc from 1.72.1 to 1.79.3 in /src/network/manifold-npm
What you expected to see, versus what you actually saw
Expected: Dependabot updates go.mod and go.sum in the target module AND runs go mod tidy on sibling modules that reference the target via replace directives, so the PR builds successfully.
Actual: Dependabot only updates go.mod and go.sum in the target module. Sibling modules with replace directives pointing to the target now have stale go.sum files — missing checksums for new transitive dependencies. The build fails with errors like:
go: module-b/go.sum: missing go.sum entry for module providing package XNative package manager behavior
Running go mod tidy manually in each dependent module after the bump resolves the issue. The native Go toolchain handles this correctly when you run go mod tidy across all affected modules.
Images of the diff or a link to the PR, issue, or logs
The pattern is reproducible in any multi-module Go repo with replace directives.
Smallest manifest that reproduces the issue
repo/
├── module-a/
│ └── go.mod:
│ module example.com/module-a
│ go 1.22
│ require google.golang.org/grpc v1.60.0
│
└── module-b/
└── go.mod:
module example.com/module-b
go 1.22
require example.com/module-a v0.0.0
replace example.com/module-a => ../module-a
When Dependabot bumps grpc in module-a, module-b/go.sum becomes stale because it's missing checksums for grpc's new transitive dependencies.