internal error: main module version is not allowed: %w

Error message

internal error: main module version is not allowed: %w

What it means

Internal invariant error inside queryProxy: the queried path is a main-module path with an 'upgrade'/'patch' query, but the supplied AllowedFunc rejected the main module's version. Because main-module versions are by definition present and not subject to external allow/deny rules, a rejection here indicates a bug in the caller's AllowedFunc or in toolchain wiring.

Source

Thrown at src/cmd/go/internal/modload/query.go:217

func queryProxy(ld *Loader, ctx context.Context, proxy, path, query, current string, allowed AllowedFunc, reuse map[module.Version]*modinfo.ModulePublic) (*modfetch.RevInfo, error) {
	ctx, span := trace.StartSpan(ctx, "modload.queryProxy "+path+" "+query)
	defer span.Done()

	if current != "" && current != "none" && !gover.ModIsValid(path, current) {
		return nil, fmt.Errorf("invalid previous version %v@%v", path, current)
	}
	if cfg.BuildMod == "vendor" {
		return nil, errQueryDisabled
	}
	if allowed == nil {
		allowed = func(context.Context, module.Version) error { return nil }
	}

	if ld.MainModules.Contains(path) && (query == "upgrade" || query == "patch") {
		m := module.Version{Path: path}
		if err := allowed(ctx, m); err != nil {
			return nil, fmt.Errorf("internal error: main module version is not allowed: %w", err)
		}
		return &modfetch.RevInfo{Version: m.Version}, nil
	}

	if path == "std" || path == "cmd" {
		return nil, fmt.Errorf("can't query specific version (%q) of standard-library module %q", query, path)
	}

	repo, err := lookupRepo(ld, ctx, proxy, path)
	if err != nil {
		return nil, err
	}

	if old := reuse[module.Version{Path: path, Version: query}]; old != nil {
		if err := checkReuseRepo(ctx, repo, path, query, old.Origin); err == nil {
			info := &modfetch.RevInfo{
				Version: old.Version,
				Origin:  old.Origin,

View on GitHub (pinned to b6b368adc5)

Solutions

If you maintain a tool calling this API, ensure AllowedFunc permits (returns nil) for main-module versions.
As an end user seeing this, it indicates a Go toolchain bug — report it at https://go.dev/issue with the reproduction.
Retry with GOFLAGS=-mod=mod and a clean cache to rule out a transient state corruption.

Example fix

// before (custom caller)
allowed := func(ctx, m) error { return errors.New("no") }
queryProxy(..., "upgrade", ..., allowed)
// error: internal error: main module version is not allowed: no

// after
allowed := func(ctx, m) error {
    if ld.MainModules.Contains(m.Path) { return nil }
    return checkExternal(m)
}

Defensive patterns

Strategy: validation

Validate before calling

// In custom tooling, default AllowedFunc to permit main-module paths:
//   allowed := func(ctx context.Context, m module.Version) error {
//       if ld.MainModules.Contains(m.Path) { return nil }
//       return externalCheck(ctx, m)
//   }

Type guard

func safeAllowed(ld *Loader, external AllowedFunc) AllowedFunc {
    return func(ctx context.Context, m module.Version) error {
        if ld.MainModules.Contains(m.Path) { return nil }
        if external == nil { return nil }
        return external(ctx, m)
    }
}

Prevention

Always let AllowedFunc return nil for main-module paths.
Unit-test AllowedFunc against the main module before wiring it into queryProxy.
Log AllowFunc rejections in tooling to catch over-broad rules.

When it happens

Trigger: Programmatically calling queryProxy with an AllowedFunc that returns a non-nil error for the main module, or a toolchain path that injects an over-restrictive allow-list for main-module paths.

Common situations: Almost never seen by end users; appears in custom tooling built on cmd/go/internal/modload that supplies a buggy AllowedFunc, or when retraction/version-allow logic is misconfigured internally.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/861d07933050ab96. Report an issue: GitHub.