Golang x/vuln: conflict with x/tools@master

Go version

go version go1.24.3 linux/amd64

Output of `go env` in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='$HOME/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='$HOME/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3679229198=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/tmp/tmp.GBjawjYL8F/go.mod'
GOMODCACHE='$HOME/go/pkg/mod'
GOOS='linux'
GOPATH='$HOME/go'
GOROOT='$HOME/.local/share/asdf/installs/golang/1.24.3/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='$HOME/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='$HOME/.local/share/asdf/installs/golang/1.24.3/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.3'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

cd $(mktemp -d)
go mod init example.com/m
go get -tool golang.org/x/vuln/cmd/govulncheck@v1.1.4
go get -u golang.org/x/tools@master
go mod tidy

What did you see happen?

go: finding module for package golang.org/x/tools/go/packages/packagestest
go: found golang.org/x/tools/go/packages/packagestest in golang.org/x/tools/go/packages/packagestest v0.0.0-20250612192959-30120599a5ba
go: downloading golang.org/x/tools/go/expect v0.0.0
go: golang.org/x/vuln/cmd/govulncheck imports
        golang.org/x/vuln/scan imports
        golang.org/x/vuln/internal/scan imports
        golang.org/x/vuln/internal/buildinfo tested by
        golang.org/x/vuln/internal/buildinfo.test imports
        golang.org/x/tools/go/packages/packagestest imports
        golang.org/x/tools/go/expect: reading golang.org/x/tools/go/expect/go.mod at revision go/expect/v0.0.0: unknown revision go/expect/v0.0.0

What did you expect to see?

Renovate updated the indirect dependency for x/tools on several of my repos to the latest master. This caused go mod tidy to fail with the error above.

Previous (working) version was commit 439ea2f0f815f46421aaecd85ffd0f75b0a303f9, first failing version is https://cs.opensource.google/go/x/tools/+/a5f2a1893145b1c54ec841e1c5cae7f9853e724a

I'm not sure why Renovate is tracking master for x/tools, so I wouldn't call this a bug. So just a reminder to update x/vuln 😄

Comment From: gabyhelp

Related Issues

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

Comment From: cherrymui

cc @adonovan @findleyr for CL https://go.dev/cl/680755 cc @golang/vulndb

Comment From: adonovan

Thanks for the clear report, and sorry for the breakage. We are in the middle of the rather complex procedure for migrating two packages in x/tools (see #70229) into their own modules. Unfortunately I forgot that between some of the steps of this procedure there is a window during which things are broken, and I failed to ensure that they are executed in quick succession. I'm working to finish it up asap.