go-cfenv v1.23.0

Release v1.23.0

[Breaking Changes]

• The minimum Go version is now 1.25 (was 1.18). Consumers on an older toolchain must stay on v1.22.0. The old floor had become what blocked dependency maintenance: every current release of golang.org/x/net, golang.org/x/text and gomega declares a directive above it. (#38)

[Chores]

• gomega moved to v1.42.1, which depends on the maintained go.yaml.in/yaml/v3 instead of the archived gopkg.in/yaml.v3. The .modrotignore exemption that covered the archived module recorded exactly this as its removal condition, and is now gone — the archived-dependency gate runs with no exemptions at all.
• The copyloopvar and intrange linters now run. They were already enabled in .golangci.yml but golangci-lint disabled them at runtime for being newer than the project's go directive.
• Added make fuzz, a fuzz target over the VCAP_APPLICATION and VCAP_SERVICES parsing that New performs. Both documents come from the platform rather than the app, so they are the package's untrusted boundary. (#39)

[Security Updates]

• golang.org/x/net and golang.org/x/text moved to current releases, clearing the 16 known vulnerabilities their pinned versions carried between them (15 in x/net v0.35.0, 1 in x/text v0.22.0). None were reachable from this package's code, so govulncheck was always green — but scanners that report on presence rather than reachability were not, and consumers run those. (#38)

go-cfenv v1.22.0

Release v1.22.0

[Features]

• Service bindings are now read from the file named by VCAP_SERVICES_FILE_PATH when Cloud Foundry provides it, so apps with the file-based-vcap-services feature enabled work without any application change. That feature exists for bindings too large for an environment variable (RFC-0030); with it enabled Cloud Foundry does not set VCAP_SERVICES at all, which previously made cfenv.Current fail outright. The SERVICE_BINDING_ROOT form of the RFC is not supported — it follows the Kubernetes servicebinding.io layout, which has no faithful translation into the VCAP_SERVICES shape. (#28)

go-cfenv v1.21.0

Release v1.21.0

[Features]

• Service now captures the binding metadata Cloud Foundry sends but the decoder previously discarded: SyslogDrainURL, InstanceGUID, InstanceName, BindingGUID and BindingName. SyslogDrainURL is what cf cups -l sets on a user-provided instance, and InstanceName recovers the instance name for a named binding, where Name holds the binding name instead. (#25)

go-cfenv v1.20.0

Release v1.20.0

[Features]

• Service.Credential(keys ...string) reads a credential at any depth and returns it with its own type, so nested values like protocols.amqp.uri and non-string leaves like protocols.amqp.ssl are reachable. Passing the keys separately means every key is addressable, including one containing a dot such as jdbc.url. (#23)
• Service.CredentialPath("protocols.amqp.uri") is the dot-delimited form of the same lookup. It cannot address a key that itself contains a dot — use Credential for those.

[BugFixes]

• Pinned the credentials payload from #11, whose nested object once panicked the decoder, as a regression test. The defect was already fixed; the test keeps it fixed.

[Chores]

• Release notes are now assembled from per-PR changelog.d/ fragments into the annotated tag body, so cutting a release no longer requires hand-editing a notes file. CHANGELOG.md is removed; notes for v1.19.1 and earlier remain in the GitHub releases.
• The CI security job installs gitleaks with make install-gitleaks — a pinned, checksum-verified download from the shared make snippets — replacing the download step that was inlined in the workflow.
• Added a make actionlint target that lints the GitHub Actions workflow files, auto-installing actionlint on demand. It is part of make check and runs as its own step in the CI quality-gates job.

go-cfenv v1.19.1

v1.19.1

No code changes. This release is repository and supply-chain tooling only;
the library is byte-for-byte identical to v1.19.0.

Internal Changes/Improvements

• OpenSSF Scorecard now actually runs.

  The workflow referenced ossf/scorecard-action@v2. That action publishes
  no floating major tag, so the reference never resolved and every run since
  the workflow was added failed before starting — nothing was ever uploaded
  to the code-scanning tab. Pinned to v2.4.4.

• Dependabot's pinned-dependency guard now covers gomega.

  It documented the x/net and x/text pins but omitted onsi/gomega, which is
  held at v1.27.10 as the newest go1.18-compatible release. Dependabot duly
  proposed v1.42.1, which declares go 1.25.0 and would have broken the
  declared floor.

• Added CODE_OF_CONDUCT.md, CONTRIBUTING.md and SECURITY.md, taken from the
  cloudfoundry and cloudfoundry-community org sources, so this repo points at
  the same CFF vulnerability reporting address and CLA process as the rest of
  the org.

• README carries CI, CodeQL, Scorecard, Go version, release and license
  badges. The Go Reference badge is removed. Go Report Card is deliberately
  absent: that project is archived read-only and its site now serves only a
  shutdown notice.

Compatibility

No public API changes, and no changes to any .go file, go.mod or
go.sum. Consumers have no reason to upgrade from v1.19.0.

go-cfenv v1.19.0

v1.19.0

Breaking Changes

• Minimum Go version is now 1.18 (was 1.11).

  Required by the new mapstructure dependency, and by module graph
  pruning. Pruning means this library's test-only dependencies no
  longer propagate into consumers' module graphs and go.sum files.

  This is a floor for consumers, not a build constraint — the library
  is built and tested with the current Go release.

Improvements

• Both archived direct dependencies removed.

  mitchellh/mapstructure (archived 2024-06-25) is replaced by
  github.com/go-viper/mapstructure/v2 v2.5.0, the maintained fork.
  v2.5.0 specifically: earlier v2 releases could echo decoded values
  into error messages, which matters for a VCAP_SERVICES parser.

  joefitzgerald/rainbow-reporter (archived 2026-02-23) is removed.
  It coloured test output and carried no assertion logic, so tests
  now use standard go test output.

  For consumers this means archived code leaves your dependency graph:
  go-cfenv was the only path to archived mapstructure in some builds.

• One archived module remains, and it cannot reach your build.

  gopkg.in/yaml.v3 (archived 2025-04-01) is still present as an
  indirect, test-only dependency. Its only path is
  github.com/onsi/gomega/matchers, so it is not part of a consumer's
  build of this library, and nothing here imports it outside tests.

  It is not removable by upgrading: every published gomega release
  requires it. It is recorded in .modrotignore with that rationale, so
  the archived-dependency gate still fails on anything new.

• Dead ginkgo requirement dropped.

  Left over from the earlier move to sclevine/spec; it had no imports.

• Transitive x/net and x/text raised to their newest go1.18-compatible
  releases, clearing advisories reported by dependency scanners.

Internal Changes/Improvements

• Makefile with build, test, quality, and audit targets.

• GitHub Actions replaces Travis CI, which had not run for years.
  Includes a compile-only job at the declared Go floor.

• golangci-lint, CodeQL code scanning, OpenSSF Scorecard, and
  Dependabot for both Go modules and workflow actions.

• modrot runs in the audit target, failing the build if an archived
  dependency is ever reintroduced.

Compatibility

No public API changes. No exported identifiers added, removed, or
changed; error strings and JSON marshalling are unchanged.

v1.18.0

• Release as a go module
• Add volume services support (#26)
• Reorganize tests

Detailed changes: v1.17.0...v1.18.0

v1.15.0

• Add Limits, which gives you access to the limits associated with your app
• Add CFAPI, which gives you the cloud controller API URI
• Disambiguate InstanceID and AppID, but continue setting ID to instance_id for backwards compatibility

Via #21, thanks @maplebed!

v1.14.0

Add space name and space id from VCAP_APPLICATION

v1.13

Remove glide.yaml; this is a library, and shouldn't be vendored.