JanssenProject / JanssenProject/jans
cedarling_go and cedarling-krakend still declare EOL Go language versions
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 648
- Forks
- 174
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 110
Description
Follow-up to [#14997](https://github.com/JanssenProject/jans/pull/14997), which moved the CI toolchain for these modules onto Go 1.26 but deliberately left their `go` directives alone.
## Current state
| Module | `go` directive |
|---|---|
| `jans-cedarling/bindings/cedarling_go` | `go 1.20` |
| `jans-cedarling/cedarling-krakend` | `go 1.22.9` |
For comparison, the two modules covered by #14997 are on `go 1.26.0` with `toolchain go1.26.8`.
## Why this is not urgent
A newer toolchain compiles an older language version fine, so nothing is broken and nothing is exposed:
- `go-version: '1.26'` in `test-cedarling.yml` and `build-packages.yml` means CI already builds and ships these with a patched toolchain, regardless of the directive.
- osv-scanner emits no package for a `go` directive, so this produces no Scorecard or OSV finding.
## Why it is still worth doing
The directive is the module's declared language floor, and 1.20 / 1.22 are both well outside Go's two-major support window. Anyone consuming the module at that floor gets a toolchain that receives no security fixes, and the floors block use of newer language and stdlib features.
## The actual decision
`cedarling_go` is a **published Go binding** — raising its floor is consumer-facing and would drop anyone still on Go 1.20–1.25. That is a compatibility call for the Cedarling maintainers, not a mechanical dependency bump, which is why it was kept out of #14997.
Also worth noting: `cedarling-krakend` requires `cedarling_go` at a pinned pseudo-version (`v0.0.0-20260327092028-934291d101e0`), so the two should move together.
## Verification already done
`GOTOOLCHAIN=go1.26.8 go mod tidy` leaves `go.mod` and `go.sum` unchanged in both modules, so `test-cedarling.yml`'s tidy-diff gate will not fight a directive bump.
## Tasks
- [ ] Decide the minimum Go version `cedarling_go` should support, and whether it warrants a version bump / changelog note for consumers
- [ ] Raise the `go` directive in both modules, keeping `cedarling-krakend` in step with the `cedarling_go` pseudo-version it pins
- [ ] Confirm `go mod tidy` stays clean and the cedarling_go test, benchmark, and package jobs pass
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the go.mod files in jans-cedarling/bindings/cedarling_go and jans-cedarling/cedarling-krakend, then review the pinned cedarling_go pseudo-version and the compatibility decision required for the published binding. Confirm the chosen floor with Cedarling maintainers, raise both directives together, and run GOTOOLCHAIN=go1.26.8 go mod tidy plus the cedarling_go test, benchmark, and package jobs in test-cedarling.yml and build-packages.yml.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, go
- Domain
- backend, build-system, ci-cd
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100