What version of Go are you using (go version)?

$ go version
go version go1.19 linux/amd64

Does this issue reproduce with the latest release?

This is the latest release

What operating system and processor architecture are you using (go env)?

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/kbolino/.cache/go-build"
GOENV="/home/kbolino/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/kbolino/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/kbolino/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.19"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/kbolino/Documents/GoModules/example/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3709996128=/tmp/go-build -gno-record-gcc-switches"

What did you do?

N.B.: I am not picking on the two chosen modules here, they just happened to be those which I was using when I noticed the problem, and I wasn't able to deduce the root cause and thus cannot reduce to a (more) minimal reproducible example.

1. Create a new module in an empty directory

   $ go mod init example.com/indirect

2. Create a simple main.go using the ristretto package

   package main
   
   import "github.com/dgraph-io/ristretto"
   
   func main() {
       var _ ristretto.Cache
   }

3. Get the ristretto module and tidy the modules

   $ go get github.com/dgraph-io/ristretto@v0.1.0
   $ go mod tidy -v

4. Examine the go.mod file for the presence of the go-spew module

   $ grep go-spew go.mod || echo not found
   not found

5. Update main.go to use the dynamodb package

   package main
   
   import (
       "github.com/aws/aws-sdk-go-v2/service/dynamodb"
       "github.com/dgraph-io/ristretto"
   )
   
   func main() {
       var _ ristretto.Cache
       var _ dynamodb.Client
   }

6. Get the dynamodb module and tidy the modules

   $ go get github.com/aws/aws-sdk-go-v2/service/dynamodb@v1.15.13
   $ go mod tidy -v

7. Check again for the presence of go-spew module

   $ grep go-spew go.mod || echo not found
   not found

8. Remove the ristretto package usage from main.go

   package main
   
   import (
       "github.com/aws/aws-sdk-go-v2/service/dynamodb"
   )
   
   func main() {
       var _ dynamodb.Client
   }

9. Tidy the modules

   $ go mod tidy -v
   unused github.com/cespare/xxhash/v2
   unused github.com/dgraph-io/ristretto
   unused github.com/dustin/go-humanize
   unused github.com/golang/glog
   unused github.com/pkg/errors
   unused golang.org/x/sys

10. Check yet again for the presence of go-spew module

    $ grep go-spew go.mod || echo not found
    github.com/davecgh/go-spew v1.1.1 // indirect

Other experiments:

• Adding dynamodb before ristretto does not change the outcome
• However, removing dynamodb instead of ristretto does change the outcome: go-spew is not added to go.mod

What did you expect to see?

Any of the following would have made sense:

1. go-spew added to go.mod by go get .../ristretto
2. go-spew added to go.mod by go get .../dynamodb
3. go-spew never added to go.mod

What did you see instead?

Instead, the go-spew module didn't show up in my go.mod until after I removed the ristretto module.

Both ristretto and dynamodb seem to require go-spew indirectly; ristretto's go.mod specifies go 1.17 and thus lists go-spew explicitly, while dynamodb's go.mod specifies only go 1.15 and doesn't list any indirect requirements.