Repository navigation
chore(deps): update and align Go dependencies across modules - #1033
Merged
mbrandenburger merged 6 commits intoOct 31, 2026
Merged
Conversation
v0.42 changes Container.MappedPort to take the port as a string and to return the moby network.Port, which has Num instead of Int. Adapt the two irb tests. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
- fabric-gateway v1.13.0 (root, ccapi) - fabric-contract-api-go v2.2.4 (root); v2.2.3+ needed Go 1.26.7 and now fits Go 1.27.3 - cc-tools-demo ccapi, cfssl v1.7.1, zlint v3.7.2, zcrypto and mongo-driver v2.9.2 (ccapi) fabric-config stays at v0.1.0 in ccapi: v0.3 moves protolator to the protobuf v2 API, which breaks fabric-sdk-go. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
All modules now build every shared dependency with the same version. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
mbrandenburger
added a commit
to mbrandenburger/fabric-private-chaincode
that referenced
this pull request
Oct 30, 2026
Address the review of hyperledger#1033; aligncheck could pass with modules whose versions differ: - A module whose packages failed to load dropped out of the comparison, since go list errors were discarded. Fail instead. - With a go.work, all modules resolve one build list, so they always agreed. Run with GOWORK=off. - Replaced modules were skipped. Compare them with their replacement version; only local path replaces are skipped. - Files behind the tools and deps build tags were not counted. Include them. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
Checks that all Go modules of the repository build each dependency with the same version, and lists any that differ. Only dependencies whose packages are compiled count: go mod tidy drops pins of modules that are merely in a module graph, so those cannot be aligned. It fails when a module's packages cannot be loaded, resolves each module on its own (GOWORK=off), compares replaced modules by their replacement version and includes the tools and deps build tags. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
- fabric-admin-sdk v0.1.0 -> v0.2.1, used by the integration test utils for the chaincode lifecycle. The API FPC uses is unchanged; the TLS change in v0.2 (hyperledger#237) does not apply, as FPC passes in its own gRPC connection. - fabric-samples asset-transfer-basic, kept in go.mod by utils/tools.go. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
None of these modules is in the module graph anymore, so the replaces had no effect; every module resolves the same build list without them. - orion-sdk-go and orion-server: FSC dropped its Orion platform - kilic/bls12-377: was only needed by the Orion dependencies - btcsuite/btcd (integration/go_chaincode), go.etcd.io/etcd (irb) - Shopify/sarama, renamed to IBM/sarama (confidential-escrow) The local path replaces and the FSC placeholder replaces are still required. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
mbrandenburger
force-pushed
the
chore/go-deps-align
branch
from
October 30, 2026 17:54
00930d9 to
069b849
Compare
munapower
approved these changes
Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates Go dependencies across all seven modules and makes every module build each shared dependency at the same version.
Commits:
f7d402c0testcontainers-go v0.44.0 (irb). v0.42 changedMappedPortto take a string and return moby'snetwork.Port, which hasNuminstead ofInt; two irb tests are adapted.8fbada10fabric-gateway v1.13.0 (root, ccapi), fabric-contract-api-go v2.2.4 (root), and cc-tools-demo, cfssl, zlint, zcrypto and mongo-driver (ccapi)eeed0cc4quic-go v0.64.1 in ccapi, to match the FSC modules2ef6600f./scripts/gomate.sh aligncheck: fails and lists any dependency that two modules build at different versions. It also fails when a module's packages can't be loaded, runs withGOWORK=off, compares replaced modules by their replacement version, and includes thetoolsanddepsbuild tags.1341d6ccfabric-admin-sdk v0.2.1 and fabric-samplesasset-transfer-basic069b849bRemove 12replacedirectives whose modules are no longer in any module graph: orion-sdk-go/orion-server and kilic/bls12-377 (FSC dropped Orion), btcd, etcd, and Shopify/sarama. Every module resolves the same build list without them. The local path replaces and the FSC placeholder replaces stay.Alignment: 202 dependencies are compiled by more than one module, and all modules now use the same version of each. Before this PR three differed (fabric-chaincode-go/v2, fabric-gateway, quic-go). The full module graphs can't be made identical.
go list -m allalso lists modules that a module doesn't compile, only because some dependency'sgo.modmentions them, and their version comes from thatgo.mod.go mod tidydrops any pin we add for them; pinning them for real would need areplaceper module in everygo.mod.alignchecktherefore counts compiled dependencies only.Notes:
go.modbyutils/tools.go; no FPC code builds against it. The newer version no longer pulls in fabric-chaincode-go v1, fabric-contract-api-go v1 or fabric-protos-go v1.Tested locally with Go 1.27.3: all modules build and vet, including the root module's integration packages, the root unit tests pass, the
tooldependencies build,aligncheckpasses, andgo mod tidy -diffis clean everywhere. The integration tests run in CI.