mod update panics when dependencies are from multiple registries

[srall-fetch]

Expected Behavior

Given the following buf.yaml file:

version: v1
deps:
  - buf.build/bufbuild/protovalidate
  - private.registry/org/dependency # removed actual private dependency
breaking:
  use:
    - FILE
lint:
  use:
    - DEFAULT

When running buf mod update, I would expect my dependencies to be properly versioned in my buf.lock file. If it's intentional to not support multiple registries, then I would assume an error stating that would be provided.

Current Behavior

The cli panics with a nil pointer dereference. Switching all dependencies to the same registry (in my case I switched them all to the same private registry) the command works fine.

pop-os% buf mod update
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
        panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x11458b4]

goroutine 1 [running]:
go.opentelemetry.io/otel/sdk/trace.(*recordingSpan).End.func1()
        go.opentelemetry.io/otel/sdk@v1.20.0/trace/span.go:388 +0x25
go.opentelemetry.io/otel/sdk/trace.(*recordingSpan).End(0xc00045c600, {0x0, 0x0, 0x0?})
        go.opentelemetry.io/otel/sdk@v1.20.0/trace/span.go:426 +0xa3b
panic({0x12b58e0?, 0x2688bf0?})
        runtime/panic.go:920 +0x270
github.com/bufbuild/buf/private/buf/cmd/buf/command/mod/modupdate.getDependencies({0x1800f10, 0xc00047a070}, 0x1?, {0x181f2e8, 0xc0000d9800}, 0xc000123db8, 0xc0000d9d00, {0x180ac40?, 0xc00003f0b0}, {0x160365c, ...})
        github.com/bufbuild/buf/private/buf/cmd/buf/command/mod/modupdate/modupdate.go:272 +0x5d4
github.com/bufbuild/buf/private/buf/cmd/buf/command/mod/modupdate.run({0x1800f10, 0xc00047a070}, {0x181f2e8?, 0xc0000d9800}, 0x0?)
        github.com/bufbuild/buf/private/buf/cmd/buf/command/mod/modupdate/modupdate.go:119 +0x272
github.com/bufbuild/buf/private/buf/cmd/buf/command/mod/modupdate.NewCommand.func1({0x1800f10?, 0xc00047a070?}, {0x181f2e8?, 0xc0000d9800?})
        github.com/bufbuild/buf/private/buf/cmd/buf/command/mod/modupdate/modupdate.go:61 +0x2b
github.com/bufbuild/buf/private/buf/cmd/buf/command/mod/modupdate.NewCommand.NewErrorInterceptor.func3.1({0x1800f10?, 0xc00047a070?}, {0x181f2e8?, 0xc0000d9800?})
        github.com/bufbuild/buf/private/buf/bufcli/errors.go:91 +0x2b
github.com/bufbuild/buf/private/pkg/app/appflag.(*builder).run(0xc000466680, {0x1800ea0, 0xc000370000}, {0x180a870, 0xc000370190}, 0xc00005a680)
        github.com/bufbuild/buf/private/pkg/app/appflag/builder.go:138 +0x525
github.com/bufbuild/buf/private/pkg/app/appflag.(*builder).NewRunFunc.func1({0x1800ea0, 0xc000370000}, {0x180a870, 0xc000370190})
        github.com/bufbuild/buf/private/pkg/app/appflag/builder.go:95 +0x7c
github.com/bufbuild/buf/private/pkg/app/appcmd.commandToCobra.func2(0xc000401100?, {0x26ee1c0?, 0x0, 0x15fc4ba?})
        github.com/bufbuild/buf/private/pkg/app/appcmd/appcmd.go:303 +0x222
github.com/spf13/cobra.(*Command).execute(0xc0000fcf00, {0x26ee1c0, 0x0, 0x0})
        github.com/spf13/cobra@v1.8.0/command.go:987 +0xaa3
github.com/spf13/cobra.(*Command).ExecuteC(0xc000004300)
        github.com/spf13/cobra@v1.8.0/command.go:1115 +0x3ff
github.com/spf13/cobra.(*Command).Execute(...)
        github.com/spf13/cobra@v1.8.0/command.go:1039
github.com/bufbuild/buf/private/pkg/app/appcmd.run({0x1800ea0, 0xc000370000}, {0x180a870?, 0xc0000ce050?}, 0xc000695080)
        github.com/bufbuild/buf/private/pkg/app/appcmd/appcmd.go:251 +0x8fc
github.com/bufbuild/buf/private/buf/cmd/buf.Main.Main.newRunFunc.func1({0x1800ea0?, 0xc000370000?}, {0x180a870?, 0xc0000ce050?})
        github.com/bufbuild/buf/private/pkg/app/appcmd/appcmd.go:110 +0x2b
github.com/bufbuild/buf/private/pkg/app.Run({0x1800e30?, 0x26ee1c0?}, {0x180a870?, 0xc0000ce050}, 0xc00061ff00)
        github.com/bufbuild/buf/private/pkg/app/app.go:317 +0x74
github.com/bufbuild/buf/private/pkg/app.Main({0x1800e30, 0x26ee1c0}, 0x0?)
        github.com/bufbuild/buf/private/pkg/app/app.go:307 +0x9d
github.com/bufbuild/buf/private/pkg/app/appcmd.Main(...)
        github.com/bufbuild/buf/private/pkg/app/appcmd/appcmd.go:91
github.com/bufbuild/buf/private/buf/cmd/buf.Main({0x15fbbae?, 0xc0000061a0?})
        github.com/bufbuild/buf/private/buf/cmd/buf/buf.go:83 +0x47
main.main()
        github.com/bufbuild/buf/cmd/buf/main.go:20 +0x1f

Steps to Reproduce

1. add dependencies from multiple registries to your buf.yaml file
2. run buf mod update

[nicksnyder]

Depending on modules from multiple registries is not supported, but the fact that this panics is definitely a bug we should fix. Thank you for the reproducible example.

@emcfarlane I think this is a regression from https://github.com/bufbuild/buf/pull/2465/files. If the server doesn't exist at all then moduleConfig.ModuleIdentity is nil, which will panic. Can you take a look?