GO.SUM IS NOT A LOCKFILE

Summary from the TLDR Dev newsletter

go.sum is a local security cache for module hashes with no impact on version resolution.