Version selection and checksums

Minimal version selection chooses the highest required minimum version of each module in the build list. Adding a dependency can raise a transitive minimum even if your direct requirement did not change.

go.sum authenticates module content hashes; it does not select versions or act as a lockfile. The proxy and checksum database have separate roles, and private module configuration changes where requests are sent.

Inspect go mod graph, go list -m all and go mod why before changing pins. A replace directive changes source selection in the main module/workspace and can mask a compatibility failure that consumers will still see.