How can I force a specific package version using go.mod?

Question

In my go.mod , I have:

...
require (
  ...
  sigs.k8s.io/controller-runtime v0.2.0-alpha.0
) 

and for some reason, when I save my files, my go.sum gets updated to include:

sigs.k8s.io/controller-runtime v0.2.0-alpha.0 h1:WM6lus3SNU4SsMlDYvjJ5fyLsG9nW3ffb/4/FpE2ZGrtnc=
sigs.k8s.io/controller-runtime v0.2.0-alpha.0/go.mod h1:HFAsYoOh6XMV+jKF1rsUjFwrknPbowfyHEHH5fRdJMf2jMX8=
sigs.k8s.io/controller-runtime v0.6.3 h1:SBbr+inLPEKhrf87vlJtrvDcwIpm+uhDvp63Bl72xYJtoOE=
sigs.k8s.io/controller-runtime v0.6.3/go.mod h1:WlZNXcMs40++oyaQt4B7Cs2lEE5JYRs8vJUznj4aRP4N4JpdAY=

The first 2, I understand why they are there. However, why does the latest version ( 0.6.3 ) of the package also appear all of a sudden?

When I run, go mod tidy , I get errors suggesting that 2 files in my codebase point to packages in the latest version ( 0.6.3 ) of this package. What can I do to strictly use the 0.2.2 version in go modules + in my codebase?

go mod tidy :

<filename here> imports
    sigs.k8s.io/controller-runtime/pkg/webhook/admission/builder: module sigs.k8s.io/controller-runtime@latest found (v0.6.3), but does not contain package sigs.k8s.io/controller-runtime/pkg/webhook/admission/builder

Answer 1

v0.2.0-alpha.0 appears to already be the version that your module is using, so you don't need to do anything to “force” it. (The version of the go command that you are using may be erroneously saving the go.sum file before it errors out. If that reproduces with the latest version — currently go1.16rc1 — please file an issue, with steps to reproduce it, at https://golang.org/issue/new . )

The error message is telling you that the go command is looking for a missing package ( sigs.k8s.io/controller-runtime/pkg/webhook/admission/builder ).

It is checking in the latest version of the modules that may contain that package, but the latest version (which is v0.6.3 , whereas your module requires v0.2.0-alpha.0 ) still does not contain that package.

So the go command is telling you, essentially: “I am missing the package sigs.k8s.io/controller-runtime/pkg/webhook/admission/builder , and I cannot fix it by upgrading because v0.6.3 does not contain that package either”.