$ go version
go version devel +fbc6a97222 Mon Apr 29 19:54:30 2019 +0000 linux/amd64

The problem exists with go1.12 as well.

What did you do?

Without proxy, I could run go get -u successfully. With proxy, it fails with cryptic error message.

$ export GOPROXY=direct
$ mkdir scratch; cd scratch; go mod init example
$ go get github.com/spf13/viper
$ go get -u
go: finding golang.org/x/sys latest
go: finding golang.org/x/crypto latest
go: finding golang.org/x/tools latest
go: finding github.com/ugorji/go/codec latest
go: finding gopkg.in/check.v1 latest
go: finding golang.org/x/sync latest
go: finding golang.org/x/net latest
go: finding github.com/armon/consul-api latest

$ export GOPROXY=https://proxy.golang.org
$ mkdir scratch; cd scratch; go mod init example
$ go get github.com/spf13/viper
$ go get -u
go get: upgrading github.com/ugorji/go/codec@v0.0.0-20181204163529-d75b2dcb6bc8: reading https://proxy.golang.org/github.com/ugorji/go/codec/@v/list: 404 Not Found

What happens underneath:

The viper module or its dependencies have dependency on github.com/ugorji/go/codec@v0.0.0-20181204163529-d75b2dcb6bc8. The github.com/ugorji/go/codec does not exist in the origin at head (no go.mod file, no valid tag), but it probably existed with @d75b2dc. Thus, go mod download github.com/ugorji/go/codec@v0.0.0-20181204163529-d75b2dcb6bc8 succeeds with and without GOPROXY.

But when trying to upgrade, with GOPROXY=direct, the go command runs a sequence of git commands and detects there is no tag, no go.mod file at head and doesn't attempt to upgrade.

With GOPROXY=, the go command queries /@v/list endpoint to find available module versions. The proxy doesn't know about the named module (because the module doesn't exist according to what go list -m -v reports), so answers HTTP error (404/410/500/...). Then, the go command treats it as a hard error.

I think in this case (the list query failure), the go command should not fail but proceed as if there is no newer version to upgrade (indeed, there is no version to upgrade to!)