Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

contrib/(github and gopkg)/gorm: Mark as deprecated #2304

Merged
merged 2 commits into from
Oct 27, 2023

Conversation

ajgajg1134
Copy link
Contributor

What does this PR do?

Mark these old gorm packages as deprecated

Motivation

Make it clear to customers who are looking to use gorm which version of gorm they should use.
For details:
Gorm originally was hosted on gopkg.in, it was then moved to github.com where new versions were hosted.
Eventually there was a "v2" release AND it moved to a new org on github at gorm.io, during this move they were able to keep the "V1" tag because the import path itself changed (even though technically it's a new v2 version with breaking changes described here)

Note that the old v1 github version has not had a release since 2020 so customers should almost certainly NOT be using it anymore and there are documented CWEs*.

*To be fair, the documented CWE that I read doesn't actually seem like it's a vulnerability in Gorm and is really a mis-use of the API where users create a SQL injection attack (which I think is also equally possibly in database/sql) as described in this github comment

Reviewer's Checklist

  • Changed code has unit tests for its functionality at or near 100% coverage.
  • There is a benchmark for any new code, or changes to existing code.
  • If this interacts with the agent in a new way, a system test has been added.

For Datadog employees:

  • If this PR touches code that handles credentials of any kind, such as Datadog API keys, I've requested a review from @DataDog/security-design-and-guidance.
  • This PR doesn't touch any of that.

Unsure? Have a question? Request a review!

@ajgajg1134 ajgajg1134 requested a review from a team October 27, 2023 15:55
@github-actions github-actions bot added the apm:ecosystem contrib/* related feature requests or bugs label Oct 27, 2023
@pr-commenter
Copy link

pr-commenter bot commented Oct 27, 2023

Benchmarks

Benchmark execution time: 2023-10-27 16:15:10

Comparing candidate commit b72a873 in PR branch andrew.glaude/deprecateJinzhuGorm with baseline commit 07629d8 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 41 metrics, 0 unstable metrics.

@ajgajg1134 ajgajg1134 merged commit 568dacd into main Oct 27, 2023
52 checks passed
@ajgajg1134 ajgajg1134 deleted the andrew.glaude/deprecateJinzhuGorm branch October 27, 2023 16:51
@darccio darccio restored the andrew.glaude/deprecateJinzhuGorm branch November 16, 2023 09:42
@darccio darccio deleted the andrew.glaude/deprecateJinzhuGorm branch November 16, 2023 09:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
apm:ecosystem contrib/* related feature requests or bugs
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants