When creating an overlay for lego I get error: go: inconsistent vendoring in /build/source

Hi all,

I am creating an overlay to get the latest in master branch of lego like this:

self: super:
{
  lego = super.lego.overrideAttrs (old: {
    version = "9db046581b7706126d21eb693ce249fe197fa688";
    src = super.fetchFromGitHub {
      owner = "go-acme";
      repo = "lego";
      rev = "9db046581b7706126d21eb693ce249fe197fa688";
      sha256 = "sha256-gtjX8QceyubdrKED4XB5Ejrm2erYlL/sIBOLc9cGQok=";
    };
    vendorHash = null;
  });
}

when I rebuild I get:

go: inconsistent vendoring in /build/source:
        cloud.google.com/go/compute/metadata@v0.2.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/nrdcg/nodion@v0.1.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/simplesurance/bunny-go@v0.0.0-20221115111006-e11d9dc91f04: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        golang.org/x/net@v0.7.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        golang.org/x/oauth2@v0.5.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        google.golang.org/api@v0.111.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        cloud.google.com/go/compute@v1.18.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/googleapis/enterprise-certificate-proxy@v0.2.3: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        github.com/googleapis/gax-go/v2@v2.7.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        go.opencensus.io@v0.24.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        golang.org/x/sys@v0.5.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        golang.org/x/text@v0.7.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        google.golang.org/genproto@v0.0.0-20230223222841-637eb2293923: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        google.golang.org/grpc@v1.53.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        google.golang.org/protobuf@v1.28.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
        cloud.google.com/go@v0.54.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        github.com/googleapis/gax-go/v2@v2.0.5: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        go.opencensus.io@v0.22.3: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        golang.org/x/net@v0.5.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        golang.org/x/oauth2@v0.4.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        golang.org/x/sys@v0.4.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        golang.org/x/text@v0.6.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        google.golang.org/api@v0.20.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        google.golang.org/genproto@v0.0.0-20211021150943-2b146023228c: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        google.golang.org/grpc@v1.41.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
        google.golang.org/protobuf@v1.28.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod

        To ignore the vendor directory, use -mod=readonly or -mod=mod.
        To sync the vendor directory, run:
                go mod vendor

I am not a go expert, but it seems I need to get it to rebuild the vendor directory. If that is what I should do, how should I do that?

any thoughts on how I can fix this issue? What am I doing wrong?

Thanks all for help.

Maybe these two are related: