fix: replace hashicorp/go-version with golang.org/x/mod/semver#532
fix: replace hashicorp/go-version with golang.org/x/mod/semver#532
Conversation
The hashicorp/go-version package uses an MPL-2.0 license that triggers Snyk license policy violations. Replace it with golang.org/x/mod/semver (BSD-3-Clause) which is already a direct dependency.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #532 +/- ##
==========================================
+ Coverage 71.26% 71.31% +0.04%
==========================================
Files 222 222
Lines 18698 18706 +8
==========================================
+ Hits 13326 13341 +15
+ Misses 4189 4186 -3
+ Partials 1183 1179 -4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
mwbrooks
added
code health
| r := ensureVPrefix(release) | ||
| c := ensureVPrefix(current) | ||
| if !semver.IsValid(r) { | ||
| return false, slackerror.New(slackerror.ErrInvalidSemVer) |
There was a problem hiding this comment.
There was a problem hiding this comment.
🧠 I could update this with a verbose log.
I had the same concern about not wrapping the error, but there is no error returned anymore. We could manually create a descriptive error, I suppose. But the ErrInvalidSemVer already captures the core essence.
There was a problem hiding this comment.
@mwbrooks Not blocking at all! I meant to suggest a "message" change with this but was also stumped about what'd be meaningful to include:
| return false, slackerror.New(slackerror.ErrInvalidSemVer) | |
| return false, slackerror.New(slackerror.ErrInvalidSemVer). | |
| WithMessage("Value %s is not a semantic versioning", r) |
There was a problem hiding this comment.
I like it! Commit f152325 adds the .WithMessage to each clause.
| return false, slackerror.New(slackerror.ErrInvalidSemVer) | ||
| } | ||
| return releaseVersion.GreaterThan(currentVersion), nil | ||
| return semver.Compare(r, c) > 0, nil |
|
Thanks for the review @zimeg! 🎉 It'll be nice to have one less dependency and to get Snyk off our back about a license policy. |
2 participants
Changelog
Summary
This pull request fixes a Synk license policy issue by removing the direct dependency on
github.com/hashicorp/go-version(MPL-2.0 license).We now use
golang.org/x/mod/semver, which is already a direct dependency. Thego-versionremains as an indirect dependency through the linter tooling, but is no longer flagged by Snyk.Preview
Testing
Requirements