proposal: cmd/go: 'go mod tidy' should remove stale 'replace' directives

[neclepsio]

What version of Go are you using (go version)?

$ go version
go version go1.12 windows/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GOARCH=amd64
set GOBIN=
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOOS=windows
set GOPROXY=
set GORACE=
set GOTMPDIR=

What did you do?

I created a go.mod file with two replaces in separate lines, then run go mod tidy. foo3 replacement is unused.

replace foo => bar
replace foo2 => bar2
replace foo3 => bar3

What did you expect to see?

A nicely formatted go.mod. Moreover, I think the unused replace should be removed.

replace (
        foo => bar
        foo2 => bar2
)

What did you see instead?

The file is unchanged. Also, go mod edit -fmt does not format replaces.

[bcmills]

See also #29813.

[rsc]

In general we don't override grouping. If you wrote three replace lines, they should stay three separate replace lines. (Especially if there are comments involved, but even if not.)

I will retitle this to be about unused replaces, which are not as clearly off the table. It's tied up with #29813, though, and in general I'm hesitant to make tidy throw away info that might be needed.

[stone-z]

+1 for removing unused replaces automatically.

My use case is that we sometimes have to replace nested dependencies in order to avoid using versions with known vulnerabilities. When the vulnerable version is no longer referenced by a direct or indirect dependency, it would be nice for the replaces to disappear.

I feel this also makes sense to preserve the expected future behavior. If a dependency is removed and then re-added sometime in the future, it probably should not be overridden by default. The user adding the dependency may not know anything about the context for the older replace (which may or may not still be valid), but probably expects to have the dependency they added.

[jboelter]

Ran into a scenario where I typo'd a path in a replacement directive and spent way too long trying to figure out why my replacement wasn't working.

An error or warning for unused replace directives for tidy, vendor, and verify and allow the user to identify and correct the intended behavior.

This replace will silently do nothing:

module example

go 1.15

require (
    github.com/path/example v1.0.0
)

replace github.com/path/typo => github.com/myfork/example v1.2.3