Skip to content

chore(deps): update and align Go dependencies across modules - #1033

Merged
mbrandenburger merged 6 commits into
hyperledger:mainfrom
mbrandenburger:chore/go-deps-align
Oct 31, 2026
Merged

mbrandenburger merged 6 commits into
hyperledger:mainfrom
mbrandenburger:chore/go-deps-align

Conversation

@mbrandenburger

@mbrandenburger mbrandenburger commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Updates Go dependencies across all seven modules and makes every module build each shared dependency at the same version.

Commits:

  • f7d402c0 testcontainers-go v0.44.0 (irb). v0.42 changed MappedPort to take a string and return moby's network.Port, which has Num instead of Int; two irb tests are adapted.
  • 8fbada10 fabric-gateway v1.13.0 (root, ccapi), fabric-contract-api-go v2.2.4 (root), and cc-tools-demo, cfssl, zlint, zcrypto and mongo-driver (ccapi)
  • eeed0cc4 quic-go v0.64.1 in ccapi, to match the FSC modules
  • 2ef6600f ./scripts/gomate.sh aligncheck: fails and lists any dependency that two modules build at different versions. It also fails when a module's packages can't be loaded, runs with GOWORK=off, compares replaced modules by their replacement version, and includes the tools and deps build tags.
  • 1341d6cc fabric-admin-sdk v0.2.1 and fabric-samples asset-transfer-basic
  • 069b849b Remove 12 replace directives whose modules are no longer in any module graph: orion-sdk-go/orion-server and kilic/bls12-377 (FSC dropped Orion), btcd, etcd, and Shopify/sarama. Every module resolves the same build list without them. The local path replaces and the FSC placeholder replaces stay.

Alignment: 202 dependencies are compiled by more than one module, and all modules now use the same version of each. Before this PR three differed (fabric-chaincode-go/v2, fabric-gateway, quic-go). The full module graphs can't be made identical. go list -m all also lists modules that a module doesn't compile, only because some dependency's go.mod mentions them, and their version comes from that go.mod. go mod tidy drops any pin we add for them; pinning them for real would need a replace per module in every go.mod. aligncheck therefore counts compiled dependencies only.

Notes:

  • fabric-admin-sdk is used only by the integration test utils for the chaincode lifecycle. The API FPC uses is unchanged. The TLS change in v0.2 (Updated README to be clearer on how to develop using the Docker Conta… #237) doesn't apply, since FPC passes in its own gRPC connection.
  • fabric-samples is only kept in go.mod by utils/tools.go; no FPC code builds against it. The newer version no longer pulls in fabric-chaincode-go v1, fabric-contract-api-go v1 or fabric-protos-go v1.
  • fabric-config stays at v0.1.0 in ccapi: v0.3 moves protolator to the protobuf v2 API, which breaks fabric-sdk-go.

Tested locally with Go 1.27.3: all modules build and vet, including the root module's integration packages, the root unit tests pass, the tool dependencies build, aligncheck passes, and go mod tidy -diff is clean everywhere. The integration tests run in CI.

v0.42 changes Container.MappedPort to take the port as a string and to
return the moby network.Port, which has Num instead of Int. Adapt the
two irb tests.

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
- fabric-gateway v1.13.0 (root, ccapi)
- fabric-contract-api-go v2.2.4 (root); v2.2.3+ needed Go 1.26.7 and
  now fits Go 1.27.3
- cc-tools-demo ccapi, cfssl v1.7.1, zlint v3.7.2, zcrypto and
  mongo-driver v2.9.2 (ccapi)

fabric-config stays at v0.1.0 in ccapi: v0.3 moves protolator to the
protobuf v2 API, which breaks fabric-sdk-go.

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
All modules now build every shared dependency with the same version.

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
@mbrandenburger
mbrandenburger requested a review from a team as a code owner October 30, 2026 17:26
@mbrandenburger mbrandenburger self-assigned this Oct 30, 2026
mbrandenburger added a commit to mbrandenburger/fabric-private-chaincode that referenced this pull request Oct 30, 2026
Address the review of hyperledger#1033; aligncheck could pass with modules whose
versions differ:
- A module whose packages failed to load dropped out of the
  comparison, since go list errors were discarded. Fail instead.
- With a go.work, all modules resolve one build list, so they always
  agreed. Run with GOWORK=off.
- Replaced modules were skipped. Compare them with their replacement
  version; only local path replaces are skipped.
- Files behind the tools and deps build tags were not counted. Include
  them.

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
Checks that all Go modules of the repository build each dependency
with the same version, and lists any that differ. Only dependencies
whose packages are compiled count: go mod tidy drops pins of modules
that are merely in a module graph, so those cannot be aligned.

It fails when a module's packages cannot be loaded, resolves each
module on its own (GOWORK=off), compares replaced modules by their
replacement version and includes the tools and deps build tags.

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
- fabric-admin-sdk v0.1.0 -> v0.2.1, used by the integration test
  utils for the chaincode lifecycle. The API FPC uses is unchanged; the
  TLS change in v0.2 (hyperledger#237) does not apply, as FPC passes in its own
  gRPC connection.
- fabric-samples asset-transfer-basic, kept in go.mod by utils/tools.go.

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
None of these modules is in the module graph anymore, so the replaces
had no effect; every module resolves the same build list without them.
- orion-sdk-go and orion-server: FSC dropped its Orion platform
- kilic/bls12-377: was only needed by the Orion dependencies
- btcsuite/btcd (integration/go_chaincode), go.etcd.io/etcd (irb)
- Shopify/sarama, renamed to IBM/sarama (confidential-escrow)

The local path replaces and the FSC placeholder replaces are still
required.

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
@mbrandenburger
mbrandenburger merged commit c7d3fb7 into hyperledger:main Oct 31, 2026
3 checks passed
@mbrandenburger
mbrandenburger deleted the chore/go-deps-align branch November 1, 2026 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants