DoDiODev opened a new issue, #9196: URL: https://github.com/apache/devlake/issues/9196
## What and why to refactor `backend/go.mod` still requires `github.com/aws/aws-sdk-go` (v1). AWS ended support for the v1 SDK on [2025-07-31](https://aws.amazon.com/blogs/developer/announcing-end-of-support-for-aws-sdk-for-go-v1-on-july-31-2025/): no more bug fixes, no more security fixes. v1.55.8 is the last release and deprecates every package, which is how it surfaced in #9192 (`lint` red with 11× `SA1019`). Keeping an unsupported SDK in the dependency tree means: - any future CVE in it will not be fixed upstream by AWS, - every Dependabot gomod run that touches it re-triggers the deprecation warnings, which currently have to be suppressed by a lint exclusion, - security scanners will increasingly flag it. ## Describe the solution you'd like 1. Migrate the only consumer, `backend/plugins/kiro`, to aws-sdk-go-v2 (separate issue: #9195). 2. Remove `github.com/aws/aws-sdk-go` from `backend/go.mod` / `go.sum` (`go mod tidy`). 3. Remove the temporary `staticcheck` exclusion for `SA1019` / `plugins/kiro/` from `backend/.golangci.yaml` (added in _PR to follow_). 4. Optional guard: add a `depguard` rule (or a simple grep in CI) that rejects new imports of `github.com/aws/aws-sdk-go/`, so v1 does not come back through another plugin. @warren830 — since kiro is currently the sole user of the AWS SDK in DevLake, looping you in here as well. If you plan further AWS-based plugins, starting them on v2 would avoid repeating this. ## Related issues - #9195 (code migration of the kiro plugin) - #9192 (Dependabot `go-minor-patch` group) - _PR to follow_ (temporary lint exclusion + CI paths fix) ## Additional context `q_dev`, the previous AWS-based plugin, was removed in #9079, so after the kiro migration no code in the repository depends on v1 anymore. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
