# XO1319: a third-party `use go` has no `require go` pin

Without a `require go` line, the binding follows Go's module resolution, which picks the module's latest version, and records it only in the gitignored .xo/gobind: two machines, or one machine on two days, could build different code from the same commit. The fix adds `require go <module> <version>` with the version the binding resolved; `xo mod tidy` adds missing pins too. Go's standard library packages need no line. See core 4.4 and decision 0356.

## Example

```xo
// xo.mod has no require go line
use go "github.com/google/uuid" as uuid
```

## Fix

```xo
# xo.mod
require go github.com/google/uuid v1.6.0
```

Run `xo explain XO1319` for this text in a terminal, or see
[section 10.6 of the specification](../../spec/core/#106-diagnostic-codes).