[LukeShu]

The correct answer is `go mod vendor && cat vendor/modules.txt`

[saghm]

Just to clarify, this will download the entirety of all of the dependencies in order to find out what versions are resolved? And then those versions aren't actually locked unless you keep the vendored dependencies around indefinitely?

My understanding is that the point of a lockflle is that you don't need to do that.