Replies: 3 comments 3 replies
-
There's also go-udiff which is an exported package of golang x/tools/internal/diff. There is an active proposal on making this package public in stdlib. |
Beta Was this translation helpful? Give feedback.
2 replies
-
sergi/go-diff has merged a fix, I tested with this version and all our tests still pass:
That said, I think it would still be prudent to try to replace it with a different library at some point as the support is extremely lacking. |
Beta Was this translation helpful? Give feedback.
1 reply
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
go-git
currently usesgithub.com/sergi/go-diff
'sv1.1.0
as a diff library. This version was released in Dec 22, 2019. All later versions of it contain a bug which blocksgo-git
from upgrading to them.The bug has been opened for a few years now, and there is no indication as to when this will be fixed. In order to keep
go-git
dependencies in a healthy state, here are a few options we have, which I wanted to get some opinions on:1) Fork the upstream version
1.1.0
into thego-git
org, and maintain it based ongo-git
needs.The additional maintainership burden on this must be taken into account if this was the way to go.
2) Copy only the required code into an internal package
internal/diffmatchpatch/
.The upstream licenses (MIT and Apache 2.0) are largely aligned. This would remove the current issues, but may cause the two versions to grow apart even further.
3) Do nothing. Wait until the bug gets fixed, or until when a well-maintained alternative is found, by which point we migrate into it.
In the mean time, any CVE issues that may arise on indirect dependencies from that library will be dealt with via
go.mod
replace directive.xref: #697 (comment)
3 votes ·
Beta Was this translation helpful? Give feedback.
All reactions