Replies: 3 comments 3 replies
-
Beta Was this translation helpful? Give feedback.
-
|
There's also go-udiff which is an exported package of golang x/tools/internal/diff. There is an active proposal on making this package public in stdlib. |
Beta Was this translation helpful? Give feedback.
-
|
That would be great, let's hope that proposal goes forwards. |
Beta Was this translation helpful? Give feedback.
-
|
Proposal got declined. However, I think the notes in "alternatives" are sufficient to look at this as an alternative solution instead of waiting for the chance of the bug to get fixed and/or forking... |
Beta Was this translation helpful? Give feedback.
-
|
sergi/go-diff has merged a fix, I tested with this version and all our tests still pass: That said, I think it would still be prudent to try to replace it with a different library at some point as the support is extremely lacking. |
Beta Was this translation helpful? Give feedback.
-
|
Nice find @AriehSchneier. This could work as a short term solution, but I agree that in the long term it would be better to depend on a better maintained project. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
go-gitcurrently usesgithub.com/sergi/go-diff'sv1.1.0as a diff library. This version was released in Dec 22, 2019. All later versions of it contain a bug which blocksgo-gitfrom upgrading to them.The bug has been opened for a few years now, and there is no indication as to when this will be fixed. In order to keep
go-gitdependencies in a healthy state, here are a few options we have, which I wanted to get some opinions on:1) Fork the upstream version
1.1.0into thego-gitorg, and maintain it based ongo-gitneeds.The additional maintainership burden on this must be taken into account if this was the way to go.
2) Copy only the required code into an internal package
internal/diffmatchpatch/.The upstream licenses (MIT and Apache 2.0) are largely aligned. This would remove the current issues, but may cause the two versions to grow apart even further.
3) Do nothing. Wait until the bug gets fixed, or until when a well-maintained alternative is found, by which point we migrate into it.
In the mean time, any CVE issues that may arise on indirect dependencies from that library will be dealt with via
go.modreplace directive.xref: #697 (comment)
3 votes ·
Beta Was this translation helpful? Give feedback.
All reactions