How do I stop the auto importing of imported item in go outside of my project?

I have my projects that have many packages which import each other and import outside packages. When I make a change to one of my low lever packages, and then push it to git it is fine and works in that section. When I go get it for use in another project that was working perfectly I now get this go get this error:

module declares its path as: github.com/xdg-go/scram
    but was required as: github.com/xdg/scram

None of my code uses either of those directly. It looks like it automatically updated some lower external packages and broke things the used to then old import.

How do I either find out the package that is importing the wrong name or stop all auto-updates?

Solution

Unfortunately if this module is for you an indirect dependency, the best fix possible is to update whatever project you import that is directly importing it.

When that is not an option, a solution to this error is to clone the problematic repository locally and use the replace directive in your go.mod file:

module mymodule

replace github.com/xdg/stringprep => ../strprep

go 1.16.2

require (
    github.com/divjotarora/mgo v0.0.0-20190308170442-1d451d2a3149
)

where ../strprep is where the code of the required module exists in your local machine, relative to the go.mod file of your project.

The downside of this of course is that you have to replicate this palliative fix wherever you plan to go get your modules.

Note also:

divjotarora/mgo is just a random example of a project that imports one of those packages using their old import path.
I'm using xdg/stringprep as an example because I can't find modules that import xdg/scram instead, but apparently it suffers from the same issue

Beside, you can use:

go mod why <package> to find out why a certain package is listed as a dependency of your project
go mod graph to show the full dependency graph. The output is in <package> <requirement> format