This is a test repo to demonstrate the current (go1.17.2) issue when trying to use retract in go.mod to retract a version in a non-root go.mod file.

The first git commit, created by github, has the following files:

README.md
LICENCE

The second git commit (2d05d02), which is recognized by go toolchain as v0.0.0-20211016165524-2d05d02ee912, has the following files:

README.md
LICENSE
lib/
  go.mod
  lib.go

This commit demonstrates a common mistake scenario: the project put the go.mod file under a non-root directory without realizing the consequences 0 of it.

Then, the third git commit (189fa58), which is also later tagged as v0.1.0, tries to correct the mistake from the previous commit, by removing lib/go.mod and add it to the root directory instead:

README.md
LICENSE
go.mod
lib/
  lib.go

This makes https://pkg.go.dev/github.com/fishy/test-go-mod-retract@v0.1.0/lib work, but at the same time, it shows that v0.1.0 is not the "latest" version of this module, and the latest version is v0.0.0-20211016165524-2d05d02ee912. When you try go mod get github.com/fishy/test-go-mod-retract/lib@latest, it will grab v0.0.0-20211016165524-2d05d02ee912, go mod get github.com/fishy/test-go-mod-retract@latest will correctly grab v0.1.0.

So the fourth commit (fb96cca) tries to retract v0.0.0-20211016165524-2d05d02ee912, by adding the following line 1 into root go.mod file:

retract v0.0.0-20211016165524-2d05d02ee912

This does NOT work as intended, because currently retract can only be used to retract versions from the same go.mod, not other go.mod from the same repository.

Thanks to @seankhliao 2, it's possible to add back lib/go.mod, retract all versions up to a future version:

retract [v0.0.0-00000000000000-000000000000, v0.0.1-retract]

And then tag that version as lib/v0.0.1-retract. This successfully resolved the issue. lib/go.mod can be removed in the next commit.