indirect dependencies might be missed

[greg-szabo]

Indirect dependencies are not always present in the go.mod file and they might surface only with go mod tidy.

This will become a problem once we filter for more than the basic comet/SDK dependencies.

User story: I have some extra code looking for wasmvm dependencies. In the case of https://raw.githubusercontent.com/commercionetwork/commercionetwork/v4.0.0/go.mod , only wasmd is mentioned. If you run go mod tidy (or build the app), you'll see that wasmvm is an indirect dependency that has to be compiled in.

[webmaster128]

In this case go list gives you the correct result:

$ go list -m github.com/CosmWasm/wasmvm
github.com/CosmWasm/wasmvm v1.0.0

As far as I can tell this is the only way to relyably get the version of a dependency that is actually used as Go calculated the dependency version dynamically and does not write the version in use to a lockfile.