Comments (8)
so, it would be great if nancy
can do it automatically, I mean we don't need to run it like go list -m all | nancy
from nancy.
@DarthHater maybe pull the trigger on removing this in v1.0??
from nancy.
Why the go.sum should be removed? Why we cannot use both options?
from nancy.
go list -m all | nancy
works great
from nancy.
@SVilgelm it's more or less just because go.sum
files are more like a ledger of what libraries you have used, not what you are currently using. It keeps track of the sha1 of the library, so that if for some reason someone changed a tag upstream etc.... go would be able to tell you, yeah, that's not what you were using before. It provides the mechanism for golang to have deterministic
builds, but since it can have old versions of libraries in it, it doesn't provide an accurate look at what you are currently using, which is what go list -m all
does. What we'd be removing is just the ability to scan the go.sum
file itself, because people could be confused and think they are using something they aren't.
from nancy.
but it can really break the current CI scripts. I would recommend to add a deprecation message for a couple of months, then remove
from nancy.
@SVilgelm this is why we are targeting this for v1.0.0
and not in the current v0.x.y
series. It's functionality will stick around for v0.x.y
releases, which will be mostly patch and no new functionality, but removed from the v1.0.0
forward, so that people can gradually migrate :)
from nancy.
go.sum is gone. Fixed by #161
from nancy.
Related Issues (20)
- Add SARIF support HOT 1
- fix dpkg warning: missing 'Maintainer' field
- TLS Handsake Timeout error HOT 2
- Nancy produces invalid JSON again and again [bug] HOT 1
- False positive due to circular dependency HOT 4
- Homebrew: Calling bottle :unneeded is deprecated HOT 3
- Running nancy in Azure DevOps requires bash to be present in the image HOT 4
- Nancy does not respect replace directive HOT 1
- Replace directive is based on the to be replaced module path not the one which replacing it HOT 4
- Q. has any thought been given to scanning for core library vulnerabilities? HOT 2
- go install does not work - complains about replace directive HOT 3
- Install failed with go 1.18 on darwin HOT 3
- Wrong brew tap on gonancy.dev HOT 1
- Is returning 500 error when accessing OSS Index HOT 20
- Update version string to have "v" prefix expected by OSSIndex
- Task execution failure HOT 1
- Subpackages with different versions are incorrectly flagged HOT 8
- Readme: Relation to govulncheck HOT 3
- Wrongly reports runc 1.1.5 as vulnerable
- Fails to install because of github.com/golang/dep HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nancy.