The //indirect dependencies I believe are just there to track dependencies that are not in the project, or to help with caching: https://github.com/golang/go/issues/36460

In go 1.17 they were added so that project loading did not require downloading the go.mod of every dependency in the graph.

The decision process is deterministic and requires no human input, it's only there for caching / speed, so it's not like a traditional lockfile. You can delete the indirect section and it will be reconstructed exactly as before.