"Whats wrong with cli v3? It's a small change. Update go version to latest and use stdlib uuid"
The move to urfave/cli v3 is its own unit, #110, because it rewrites the same files as open work on the CLI. This issue covers the Go version, the other dependencies, the UUID package and the vulnerability check.
Context
go.mod says go 1.23 and pins dependencies that are years old and carry published advisories, and a 1.0 library imports every one of them into every consumer: golang.org/x/crypto (2022-05), golang.org/x/sys v0.1.0, golang.org/x/text v0.3.6, golang.org/x/term (2021), github.com/google/uuid v1.1.2, google.golang.org/protobuf v1.28.1, github.com/spf13/afero v1.8.0, github.com/stretchr/testify v1.8.1. Nothing in the repo runs a vulnerability check.
Definition of done
The go directive in go.mod names the latest stable Go release, and the golang image in the Dockerfile is that release, pinned by digest with a dated comment. The two agree.
github.com/google/uuid is gone: the one use (uuid.FromBytes in mfer/deserialize.go) uses the standard library's UUID package. If the latest stable Go release has no UUID package in its standard library, do not invent a replacement: keep google/uuid at its current release, say so in the PR body in one line, and the manager raises it with sneak.
Every other direct dependency except urfave/cli is at its current release; go mod tidy has been run. urfave/cli/v2 is raised to the latest v2 release only.
mfer/mf.pb.go is regenerated with the protoc-gen-go matching the new google.golang.org/protobuf and committed; the generated header names that version.
A make vulncheck target (through script/vulncheck) runs govulncheck ./... and reports no findings. The tool is pinned by hash per policy, as a module in go.sum or inside a Docker image pinned by digest; the commit message says which.
No behaviour change: existing tests pass unchanged, and a manifest generated before the update is byte-identical to one generated after it with the same --seed (add that test if none exists).
make check passes and docker build . succeeds; TODO.md updated in the same commit.
Commit title ends with (closes #102).
Model: fable-5-1
## Owner ruling (sneak, 2026-09-21, verbatim)
"Whats wrong with cli v3? It's a small change. Update go version to latest and use stdlib uuid"
The move to `urfave/cli` v3 is its own unit, https://git.eeqj.de/sneak/mfer/issues/110, because it rewrites the same files as open work on the CLI. This issue covers the Go version, the other dependencies, the UUID package and the vulnerability check.
## Context
`go.mod` says `go 1.23` and pins dependencies that are years old and carry published advisories, and a 1.0 library imports every one of them into every consumer: `golang.org/x/crypto` (2022-05), `golang.org/x/sys` v0.1.0, `golang.org/x/text` v0.3.6, `golang.org/x/term` (2021), `github.com/google/uuid` v1.1.2, `google.golang.org/protobuf` v1.28.1, `github.com/spf13/afero` v1.8.0, `github.com/stretchr/testify` v1.8.1. Nothing in the repo runs a vulnerability check.
## Definition of done
- The `go` directive in `go.mod` names the latest stable Go release, and the golang image in the `Dockerfile` is that release, pinned by digest with a dated comment. The two agree.
- `github.com/google/uuid` is gone: the one use (`uuid.FromBytes` in `mfer/deserialize.go`) uses the standard library's UUID package. If the latest stable Go release has no UUID package in its standard library, do not invent a replacement: keep `google/uuid` at its current release, say so in the PR body in one line, and the manager raises it with sneak.
- Every other direct dependency except `urfave/cli` is at its current release; `go mod tidy` has been run. `urfave/cli/v2` is raised to the latest v2 release only.
- `mfer/mf.pb.go` is regenerated with the `protoc-gen-go` matching the new `google.golang.org/protobuf` and committed; the generated header names that version.
- A `make vulncheck` target (through `script/vulncheck`) runs `govulncheck ./...` and reports no findings. The tool is pinned by hash per policy, as a module in `go.sum` or inside a Docker image pinned by digest; the commit message says which.
- No behaviour change: existing tests pass unchanged, and a manifest generated before the update is byte-identical to one generated after it with the same `--seed` (add that test if none exists).
- `make check` passes and `docker build .` succeeds; `TODO.md` updated in the same commit.
- Commit title ends with ` (closes #102)`.
Model: fable-5-1
clawbot
self-assigned this 2026-09-21 09:21:37 +02:00
clawbot
changed title from Update Go dependencies and add a vulnerability check before 1.0 to Raise Go to the latest release, update dependencies, use the standard library UUID, add a vulnerability check2026-09-22 00:31:22 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Owner ruling (sneak, 2026-09-21, verbatim)
"Whats wrong with cli v3? It's a small change. Update go version to latest and use stdlib uuid"
The move to
urfave/cliv3 is its own unit, #110, because it rewrites the same files as open work on the CLI. This issue covers the Go version, the other dependencies, the UUID package and the vulnerability check.Context
go.modsaysgo 1.23and pins dependencies that are years old and carry published advisories, and a 1.0 library imports every one of them into every consumer:golang.org/x/crypto(2022-05),golang.org/x/sysv0.1.0,golang.org/x/textv0.3.6,golang.org/x/term(2021),github.com/google/uuidv1.1.2,google.golang.org/protobufv1.28.1,github.com/spf13/aferov1.8.0,github.com/stretchr/testifyv1.8.1. Nothing in the repo runs a vulnerability check.Definition of done
godirective ingo.modnames the latest stable Go release, and the golang image in theDockerfileis that release, pinned by digest with a dated comment. The two agree.github.com/google/uuidis gone: the one use (uuid.FromBytesinmfer/deserialize.go) uses the standard library's UUID package. If the latest stable Go release has no UUID package in its standard library, do not invent a replacement: keepgoogle/uuidat its current release, say so in the PR body in one line, and the manager raises it with sneak.urfave/cliis at its current release;go mod tidyhas been run.urfave/cli/v2is raised to the latest v2 release only.mfer/mf.pb.gois regenerated with theprotoc-gen-gomatching the newgoogle.golang.org/protobufand committed; the generated header names that version.make vulnchecktarget (throughscript/vulncheck) runsgovulncheck ./...and reports no findings. The tool is pinned by hash per policy, as a module ingo.sumor inside a Docker image pinned by digest; the commit message says which.--seed(add that test if none exists).make checkpasses anddocker build .succeeds;TODO.mdupdated in the same commit.(closes #102).Model: fable-5-1
Whats wrong with cli v3? It's a small change.
Update go version to latest and use stdlib uuid
Update Go dependencies and add a vulnerability check before 1.0to Raise Go to the latest release, update dependencies, use the standard library UUID, add a vulnerability check