[ashtonian]

Workspace updates fail when member manifests replace a module with a local path outside the checkout, such as a sibling repository: the workspace path never used the single-module stub lifecycle, and members that reach one target through different relative paths produced conflicting replacements. Parser metadata commands also rewrote the first matching path text, which could be a comment rather than the replacement.

Closes #16821.

Changes

• ReplaceStubber is the one replacement lifecycle for parsing and updating. It resolves each external target's identity across the module, the workfile and every used member, points every binding at one shared stub with go mod edit / go work edit, and restores the original bindings before returning files or propagating a tooling failure. In-repository replacements stay live; the stub root is temporary and removed. Existing module-relative stub_paths callers keep working.
• An empty stub cannot show that a dependency is unused. The native helper restores requirements a stubbed replacement matched (version, // indirect, comments) and keeps original requirements an incomplete graph would prune, while keeping public version changes.
• While stubs are present, go.sum and go.work.sum keep the union of original and new entries, ordered with x/mod/module.Sort. Checksum reads and writes stay inside the checkout.
• go work sync can raise a member's requirements while their go.mod checksums are recorded only in other workspace sum files, which breaks standalone builds of that member. A stubbed workspace update now runs go mod download in each member with GOWORK=off after sync. Sync has already resolved every member graph on its own, so each member's own replacements are the complete context.
• Tidy and vendor stay disabled while stubs are present, as in the single-module path. Main's grouped go.work preservation is unchanged.

Go itself cannot update a member whose requirements resolve only through a workfile replace: with every source present, go get and go work sync both fail. The updater reports that resolution failure, with every binding restored, rather than producing an update the toolchain cannot reproduce.

Validation

Run in the current dependabot-updater-gomod image against this branch's tree:

• The native helper's manifest package passes go test, go test -race and go vet. The workspace local-replacement, ReplaceStubber and GoModManifest specs pass (83 examples), as do the affected parser cases and the existing single-module path-replace regressions. RuboCop reports no offenses in the changed files.
• A toolchain oracle (Go 1.27.0, every replacement source present) confirms the two Go behaviors the design relies on:
  • For a member that resolves only through a workfile replace, go get and go work sync fail.
  • With member replacements, go get and go work sync pass. A standalone GOWORK=off go list -mod=readonly -m all then fails on a missing go.mod checksum, and passes after go mod download.
• A real seven-module workspace replays with the hosted image digests and this source mounted. Each member reaches sibling-repository modules through its own relative replace.
  • Unchanged code fails with PathDependenciesNotReachable.
  • This branch produces one grouped proposal of 15 files and keeps every original requirement, replacement binding and checksum line.
  • Every member loads go list -deps -test ./... in the mode its CI builds it. The root and five members load standalone with GOWORK=off -mod=readonly, and all seven load in the workspace.
  • The previous head's proposal, which lacked the standalone download, fails four of those standalone loads on missing go.mod checksums.

The real-workspace replay uses dependabot/cli#693, a separate fix for the CLI's empty blocked-versions response, so the updater's existing fallback runs. This is local mounted-source evidence, not hosted rollout.

[v-markhallen]

Could we scope the protected replacements to the member they apply to? With api/go.mod replacing rsc.io/quote v1.5.1 locally and worker/go.mod using it from the registry, this restores the worker's requirement to v1.5.1 after go get rsc.io/quote@v1.5.2 succeeds. Please add a regression that keeps the registry-backed member's update.