title: How to track down where a dependency comes from in Go modules?
body: <p>I'd have a Go module, say <code>github.com/myorg/mymodule</code>, of which I'd like to update the version in another module. However, if I try to <code>go get -u</code> it, I get an <code>unexpected module path</code> error:</p>
  
  <pre><code>&gt; go get -u github.com/myorg/mymodule
  go: sourcegraph.com/sourcegraph/go-diff@v0.5.1: parsing go.mod: unexpected module path "github.com/sourcegraph/go-diff"
  go get: error loading module requirements
  </code></pre>
  
  <p>The fix for this has been documented at <a href="https://github.com/sourcegraph/go-diff/issues/35" rel="nofollow noreferrer">https://github.com/sourcegraph/go-diff/issues/35</a>: this module needs to be imported as <code>github.com/sourcegraph/go-diff/diff</code>, not <code>github.com/sourcegraph/go-diff</code>.</p>
  
  <p>The problem is, I don't know where to apply this fix - that is, which dependency is importing this sub-dependency the wrong way.</p>
  
  <p>In particular, <code>go-diff</code> does not appear in the <code>go.mod</code>, it only appears in <code>go.sum</code> (in several different modules):</p>
  
  <pre><code>&gt; grep go-diff go.mod
  &gt; grep go-diff go.sum
  github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
  github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
  github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
  sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=
  </code></pre>
  
  <p>I've tried using <code>go mod why</code>, but this simply reports that the module is not needed:</p>
  
  <pre><code>&gt; go mod why sourcegraph.com/sourcegraph/go-diff
  # sourcegraph.com/sourcegraph/go-diff
  (main module does not need package sourcegraph.com/sourcegraph/go-diff)
  </code></pre>
  
  <p>What is even more puzzling is that the error message mentions <code>go-diff@v0.5.1</code>, whereas the <code>go.sum</code> contains <code>go-diff v0.5.0</code>.</p>
  
  <p>All in all, how can I track down where this 'mis-import' of the <code>go-diff</code> dependency is happening so that I can update my version of that module?</p>