Update dependencies and drop the abandoned archiver - #13
Merged
Conversation
Every direct dependency was behind, and the current releases require Go 1.25, so the go directive moves up with them. Notably this picks up golang.org/x/crypto v0.30.0 -> v0.54.0. github.com/mholt/archiver/v3 could not be fixed by a version bump: it is abandoned upstream and govulncheck reports three vulnerabilities against it and its rardecode dependency with no fixed version available. The CLI only ever used it to build a gzipped tarball in CompressDir and never to extract one, so none were reachable in practice, but the dependency had no path forward. archive/tar and compress/gzip do the same job directly. That clears all three findings -- govulncheck now reports zero affecting this code -- and drops ten transitive modules along with it: brotli, dsnet/compress, snappy, klauspost/compress, klauspost/pgzip, rardecode, pierrec/lz4, ulikunitz/xz and xi2/xz. Add tests for CompressDir covering the archive layout, ignore prefixes and the non-directory error, since nothing covered the packaging that every deploy depends on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every direct dependency was behind:
github.com/fatih/colorgithub.com/schollz/progressbar/v3github.com/spf13/cobragolang.org/x/cryptogolang.org/x/expgolang.org/x/termThe current releases require Go 1.25, so the
godirective moves up with them. Anyone building from source now needs Go 1.25; CI reads the version fromgo.modso it follows automatically.The archiver could not be fixed by a bump
github.com/mholt/archiver/v3is abandoned upstream, andgovulncheckreported three vulnerabilities against it and itsrardecodedependency, all with no fixed version available:mholt/archivermholt/archivernwaples/rardecodeAll three are in extraction / RAR decoding paths. The CLI only ever used the library to build a gzipped tarball in
util.CompressDirand never to extract one, so none were reachable in practice — but the dependency had no path forward regardless.archive/tar+compress/gzipdo the same job directly.govulnchecknow reports zero vulnerabilities affecting this code, and ten transitive modules go away with it: brotli, dsnet/compress, snappy, klauspost/compress, klauspost/pgzip, rardecode, pierrec/lz4, ulikunitz/xz, xi2/xz.Behaviour
The tarball is byte-for-byte equivalent in structure: same relative, slash-separated entry names, same file modes via
tar.FileInfoHeader, samesymwalktraversal so symlinks are still followed, same ignore-prefix filtering. The one difference is that the redundant"."root entry is no longer emitted.Testing
go build ./...,go vet ./...andgo test ./...all pass. Newutil/util_test.gocovers the archive layout, ignore prefixes and the non-directory error — nothing previously tested the packaging step that everyvalar deploydepends on.