JanssenProject / JanssenProject/jans

cedarling_go and cedarling-krakend still declare EOL Go language versions

Open
#15,015 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

comp-jans-cedarling kind-enhancement
Dominant language
Java
Stars
648
Forks
174
Avg merge
1d 18h
Merged PRs (30d)
110

Description

Follow-up to [#14997](https://github.com/JanssenProject/jans/pull/14997), which moved the CI toolchain for these modules onto Go 1.26 but deliberately left their `go` directives alone.

## Current state

| Module | `go` directive |
|---|---|
| `jans-cedarling/bindings/cedarling_go` | `go 1.20` |
| `jans-cedarling/cedarling-krakend` | `go 1.22.9` |

For comparison, the two modules covered by #14997 are on `go 1.26.0` with `toolchain go1.26.8`.

## Why this is not urgent

A newer toolchain compiles an older language version fine, so nothing is broken and nothing is exposed:

- `go-version: '1.26'` in `test-cedarling.yml` and `build-packages.yml` means CI already builds and ships these with a patched toolchain, regardless of the directive.
- osv-scanner emits no package for a `go` directive, so this produces no Scorecard or OSV finding.

## Why it is still worth doing

The directive is the module's declared language floor, and 1.20 / 1.22 are both well outside Go's two-major support window. Anyone consuming the module at that floor gets a toolchain that receives no security fixes, and the floors block use of newer language and stdlib features.

## The actual decision

`cedarling_go` is a **published Go binding** — raising its floor is consumer-facing and would drop anyone still on Go 1.20–1.25. That is a compatibility call for the Cedarling maintainers, not a mechanical dependency bump, which is why it was kept out of #14997.

Also worth noting: `cedarling-krakend` requires `cedarling_go` at a pinned pseudo-version (`v0.0.0-20260327092028-934291d101e0`), so the two should move together.

## Verification already done

`GOTOOLCHAIN=go1.26.8 go mod tidy` leaves `go.mod` and `go.sum` unchanged in both modules, so `test-cedarling.yml`'s tidy-diff gate will not fight a directive bump.

## Tasks

- [ ] Decide the minimum Go version `cedarling_go` should support, and whether it warrants a version bump / changelog note for consumers
- [ ] Raise the `go` directive in both modules, keeping `cedarling-krakend` in step with the `cedarling_go` pseudo-version it pins
- [ ] Confirm `go mod tidy` stays clean and the cedarling_go test, benchmark, and package jobs pass

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read the go.mod files in jans-cedarling/bindings/cedarling_go and jans-cedarling/cedarling-krakend, then review the pinned cedarling_go pseudo-version and the compatibility decision required for the published binding. Confirm the chosen floor with Cedarling maintainers, raise both directives together, and run GOTOOLCHAIN=go1.26.8 go mod tidy plus the cedarling_go test, benchmark, and package jobs in test-cedarling.yml and build-packages.yml.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
backend, build-system, ci-cd
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.