DoDiODev opened a new pull request, #9061:
URL: https://github.com/apache/devlake/pull/9061
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
# Go dependency maintenance and mapstructure v2 — PR text
## Summary
This PR performs a focused Go dependency maintenance update and replaces the
archived direct `mitchellh/mapstructure` import with the maintained
`go-viper/mapstructure/v2` module. It contains no schema or migration-script
changes. A small DAL compatibility fix keeps PostgreSQL index drops working
with the updated GORM PostgreSQL driver; the affected SonarQube E2E test now
uses the same DAL abstraction. There are no API, CI, frontend, Docker-image,
or Go-toolchain changes.
## Changes
| Module | Before | After | Decision |
|---|---:|---:|---|
| `golang.org/x/mod` | `v0.38.0` | `v0.40.0` | Included; fixes GO-2026-6180
and GO-2026-6179 in the required module. |
| `gorm.io/driver/postgres` | `v1.5.2` | `v1.6.2` | Included together with
the required GORM upgrade. |
| `gorm.io/gorm` | `v1.25.5` | `v1.31.2` | Included; validated through the
normal Go build and unit-test paths. |
| `github.com/coreos/go-oidc/v3` | `v3.9.0` | `v3.20.0` | Included; the
OIDC/authentication tests pass. |
| `github.com/mitchellh/mapstructure` | `v1.5.0` direct | removed direct
requirement | All eight Go imports now use the v2 module. |
| `github.com/go-viper/mapstructure/v2` | not direct | `v2.5.0` direct |
Added as the replacement module. |
| `golang.org/x/sync` | `v0.22.0` | unchanged | Already current on the PR
base. |
The mapstructure change is an import-path-only migration. Existing struct
tags,
custom decode hooks, `WeaklyTypedInput`, and decoder configuration are
retained.
The old `mitchellh/mapstructure v1.4.1` entry that remains in `go.mod` is
transitive through `github.com/spf13/viper`; no application source imports it
any longer.
`go mod tidy` also records the expected transitive updates, including
`golang.org/x/tools v0.49.0` and `go-jose/v4` from the OIDC upgrade.
The fresh direct-module audit on 2026-08-19 also reported updates for
`aws-sdk-go`, `cockroachdb/errors`, `gin`, `validator/v10`,
`go-sql-driver/mysql`,
`google/uuid`, `ants/v2`, `cron/v3`, `cast`, `cobra`, `viper`, `swaggo`,
`gjson`,
`viant/afs`, `gorm.io/datatypes`, `gorm.io/driver/mysql`, and the previously
listed `gocsv`, `properties`, `go-internal`, `testify`, and `x/exp`. All are
explicitly deferred as independent review items; no unreviewed direct update
is bundled into this PR.
## Direct-module decisions
The pre-branch direct build-graph audit reported additional updates. They are
intentionally not bundled without their own review:
- `gocarina/gocsv`: pseudo-version update deferred pending changelog/diff
review.
- `magiconair/properties`: `v1.8.5 → v1.18.11` is a large independent jump
and
should be handled separately.
- `rogpeppe/go-internal`: `v1.14.1 → v1.16.0` deferred.
- `stretchr/testify`: `v1.11.1 → v1.12.0` deferred.
- `golang.org/x/exp`: pseudo-version update deferred pending compatibility
review.
The Go toolchain bootstrap and minimum patch level are deliberately outside
this
change.
## Validation
Completed successfully:
- `go mod tidy`
- `go test ./helpers/oidchelper/... ./server/api/auth/...`
- targeted unit tests for the mapstructure, helper, remote-scope, GitHub,
Jira, Customize, Issue Trace, and Zentao packages
- `go test ./impls/dalgorm ./plugins/sonarqube/e2e -run
'Test_validateQuery|TestSonarqubeIssueCodeBlockLongComponent' -count=1`
- `gofmt -d` over all changed Go files
- `make build` (all plugins, mocks, Swagger generation, and the server)
- `make unit-test-go`
- MySQL and PostgreSQL `make e2e-test` runs against isolated local
`lake_test`
databases, both completed with exit code 0
- `govulncheck -show verbose ./...`: no vulnerabilities reachable from the
DevLake code; three uncallable module-only findings have no fixed version
- CVE validation for `x/mod v0.40.0`, GORM `v1.31.2`, PostgreSQL driver
`v1.6.2`,
go-oidc `v3.20.0`, and mapstructure v2.5.0: no known CVEs reported
The PostgreSQL run initially exposed the updated driver's invalid
`DROP INDEX CURRENT_SCHEMA()."…"` SQL. The DAL now uses a PostgreSQL-specific
`DROP INDEX IF EXISTS` path, while retaining the existing GORM migrator path
for other dialects. The SonarQube migration E2E test passes on both the PR
branch and `upstream/main`'s older dependency baseline.
## Required pre-merge gates
- [x] Run the MySQL and PostgreSQL E2E suites with their respective test
databases.
- Create/edit at least one GitHub and one Jira connection through the UI to
exercise connection and scope-config decoding with mapstructure v2.
- Verify invalid connection credentials still produce the expected API error.
## Commit structure
1. `build(deps): bump x/mod to v0.40.0`
2. `build(deps): update gorm postgres driver`
3. `build(deps): update go-oidc`
4. `refactor(deps): replace mapstructure with go-viper v2`
5. `fix(db): keep postgres index drops compatible with updated GORM`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
