go.mod: kcp/cli dependency breaks `go mod tidy` for downstream consumers

[kaovilai]

Problem

Downstream consumers of crash-diagnostics that depend on it transitively (not as the main module) get a go mod tidy failure:

go: github.com/kcp-dev/kcp/cli@v0.27.1 requires
	github.com/kcp-dev/kcp/sdk@v0.0.0-00010101000000-000000000000: invalid version: unknown revision 000000000000

Root Cause

crash-diagnostics v0.4.3 directly requires github.com/kcp-dev/kcp/cli v0.27.1 and github.com/kcp-dev/kcp/sdk v0.27.1.

The kcp project is a mono-repo where kcp/cli's go.mod uses a local path replace:

// in github.com/kcp-dev/kcp/cli@v0.27.1 go.mod
require github.com/kcp-dev/kcp/sdk v0.0.0-00010101000000-000000000000
replace github.com/kcp-dev/kcp/sdk => ../sdk

Go module replace directives only apply to the main module and do not propagate to consumers. When Go resolves kcp/cli's go.mod transitively, it sees the phantom v0.0.0-00010101000000-000000000000 version, which does not exist on any registry.

When crash-diagnostics is the main module (or a direct dependency where MVS resolves kcp/sdk to v0.27.1 first), this works. But when crash-diagnostics is a transitive dependency (e.g., my-project → velero → crash-diagnostics), the Go toolchain tries to validate the phantom version and fails.

Impact

Every downstream consumer that depends on crash-diagnostics transitively must add a workaround in their own go.mod.

Workaround

Use exclude in the consumer's go.mod to skip the phantom version — MVS then picks up v0.27.1 from the other requirements:

// workaround for https://github.com/vmware-tanzu/crash-diagnostics/issues/283
exclude github.com/kcp-dev/kcp/sdk v0.0.0-00010101000000-000000000000

This is cleaner than a replace directive since the phantom version literally doesn't exist.

Suggested Fix

This is ultimately a kcp mono-repo issue, but crash-diagnostics could mitigate it by either:

1. Adding an exclude directive for the phantom version in crash-diagnostics' go.mod
2. Evaluating whether the kcp/cli and kcp/sdk dependencies are still needed, and removing them if not
3. Opening an upstream issue on kcp-dev/kcp to publish proper go.mod files for their sub-modules

Reproduction

go mod init example.com/test
go get github.com/vmware-tanzu/crash-diagnostics@v0.4.3
go mod tidy  # fails with the error above when crash-diagnostics is not the only dependency

Note

Responses generated with Claude