title: Why does go.sum include so many older packages
body: <p>I've been going though a set of projects, dealing with updating dependencies and there is one thing I don't have a clear answer to and that is why the generated sum file lists so many older versions of each dependency.</p>
  <p>in our project we had some vulnerabilities introduced though an older version of
  <code>golang.org/x/crypto</code>
  that we resolved though a <code>replace</code> directive to a package release with security fixes but this doesn't feel very correct and could lock us into an insecure version of a package.</p>
  <p>now I have gone though and updated the package which depended on an older version of <code>golang.org/x/crypto</code> and looped back to the package with the the replace directive and attempted an update but I still see the older packages listed.</p>
  <p>I'm wondering what this means for our project and how I can find why these are included in the first place?</p>
  <p>running a simple
  <code>go mod why -m golang.org/x/crypto</code>
  reveals that the only project dependent on
  <code>golang.org/x/crypto</code>
  was the one that I had updated.</p>