arrow_backRetour aux issues
uptrace/bun
#1385
Débutant
Ouvrirarrow_forward
Débutant
Ouvrirarrow_forward
Débutant
Ouvrirarrow_forward
Replace unmaintained github.com/tmthrgd/go-hex with stdlib encoding/hex
ecoDébutant
good first issue
stale
descriptionDescription
`github.com/tmthrgd/go-hex` has been unmaintained for ~7 years (last commit 2019). We'd love to use `bun` but our SBOM/supply-chain scanning flags it as an abandoned dependency. Since bun uses only two API-compatible functions from it afaik, I'd like to propose to replace it with the standard go library `encoding/hex`.
### Where it's used (quick search in the repo)
The dependency is imported in `internal/hex.go` - aliased as `fasthex`, using:
- `fasthex.EncodedLen(...)`
- `fasthex.Encode(...)`
Every other `hex` reference in the codebase (again quick search in the repo) already uses stdlib `encoding/hex`. It's listed as a direct dependency in the root `go.mod` and as `// indirect` across the dialect/example modules.
### Why we'd want to replace it
- It's currently unmaintained: if a defect/vulnerability were found, there's no upstream to patch it. (There are no known CVEs today — currently this is _only_ a maintenance/supply-chain concern)
- A dependency could be droppen: rather than swapping one third-party lib for another - `encoding/hex` is maintained by the Go team and patched through normal Go releases.
- AFAIK it would be API- and behavior-compatible: `EncodedLen` and `Encode` have identical signatures and semantics, so the SQL output should be unchanged.
### The only tradeoff I can see
`go-hex` provides SIMD-accelerated encoding, so stdlib `encoding/hex` may be slower when serializing large `[]byte`/`bytea` blobs. I guess for most workloads this is is probably negligible, but maybe someone can include a benchmark on a representative blob size if maintainers want to quantify it before deciding.
Happy to open a PR if this direction is acceptable.
Issues similaires
medik8s/fence-agents-remediation
star18
Poids du dépôt moyen
v0.8.0 starts a cluster-scoped Secret informer despite namespace-scoped Secret RBAC
## Description While testing Fence Agents Remediation (FAR) v0.8.0, I observed the manager repeatedly attempting to li…
Go
good first issue
Wayfare-labs/wayfare
star1
Poids du dépôt léger
Check that an issuer's home_domain round-trips to the same stellar.toml
Written to the standard set by #33 — read that issue first for the expected level of detail and the acceptance criteria…
Go
help wanted
area:corridor
Wayfare-labs/wayfare
star1
Poids du dépôt léger
Report auth_immutable: whether an issuer's flags can still change
> **This issue is the reference standard.** Every other check issue links back here for the expected level of detail. I…
Go
help wanted
good first issue