If you use go 1.17 in go.mod and run go mod tidy, you will see a second require block with indirect dependencies. Few things changed in 1.17 for dependency graph. More details here: https://go.dev/doc/go1.17#go-command
Also, few useful commands to manage dependencies
go mod tidy # fix up modules
go mod why -m <module> # shows where this module is used from main module
go mod graph # shows module requirement graph
go list -m all # list all dependencies
go list -m -u -versions -json <module> # shows versions of a module