contrib/(github and gopkg)/gorm: Mark as deprecated #2304
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Mark these old gorm packages as deprecated
Motivation
Make it clear to customers who are looking to use
gorm
which version of gorm they should use.For details:
Gorm originally was hosted on gopkg.in, it was then moved to github.com where new versions were hosted.
Eventually there was a "v2" release AND it moved to a new org on github at gorm.io, during this move they were able to keep the "V1" tag because the import path itself changed (even though technically it's a new v2 version with breaking changes described here)
Note that the old v1 github version has not had a release since 2020 so customers should almost certainly NOT be using it anymore and there are documented CWEs*.
*To be fair, the documented CWE that I read doesn't actually seem like it's a vulnerability in Gorm and is really a mis-use of the API where users create a SQL injection attack (which I think is also equally possibly in database/sql) as described in this github comment
Reviewer's Checklist
For Datadog employees:
@DataDog/security-design-and-guidance
.Unsure? Have a question? Request a review!