guptas6est opened a new pull request, #3777:
URL: https://github.com/apache/thrift/pull/3777
<!-- Explain the changes in the pull request below: -->
**Summary**
Replace the deprecated github.com/golang/mock (archived by Google in 2023)
with its official successor go.uber.org/mock in the Go test modules.
**Motivation**
github.com/golang/mock v1.6.0 pulls in ancient transitive dependencies
(golang.org/x/crypto from 2019, golang.org/x/net from 2021, etc.) that are
flagged by vulnerability scanners with 54 CVEs (34 HIGH, 18 MEDIUM, 2 UNKNOWN).
While these are not exploitable in practice (the vulnerable code paths are
never exercised by the test suite), they create noise in security scans and
mask real findings.
go.uber.org/mock is the community-maintained continuation of the same
project with an identical API — the migration is a mechanical import path
replacement.
**Changes**
- Replaced github.com/golang/mock with go.uber.org/mock v0.5.0 in
lib/go/test/go.mod and test/go/go.mod
- Updated import paths in 5 Go source files
(s/github.com/golang/mock/gomock/go.uber.org/mock/gomock/)
- Ran go mod tidy -e to clean up go.sum
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
