Code Dependencies Review and Fixes [High]

[AkramBitar]

Fabric Token SDK: Problematic Dependencies Analysis

Fabric Token SDK: Problematic Dependencies Analysis

Found 30 unique problematic dependencies across 6 go.mod files.

1. From Fabric Smart Client (21 dependencies)

These dependencies are attributable to github.com/hyperledger-labs/fabric-smart-client or FSC-driven transitive paths. They are not realistically removable from this repository alone and require FSC-side dependency updates.

1. github.com/whyrusleeping/go-keyspace - NOT MAINTAINED - Via FSC → libp2p
2. github.com/benbjohnson/clock - ARCHIVED - Via FSC → libp2p
3. github.com/marten-seemann/tcp - ARCHIVED - Via FSC → libp2p
4. github.com/mikioh/tcpinfo - NOT MAINTAINED - Via FSC → libp2p
5. github.com/mikioh/tcpopt - NOT MAINTAINED - Via FSC → libp2p
6. github.com/spaolacci/murmur3 - NOT MAINTAINED - Via FSC → libp2p
7. github.com/munnerz/goautoneg - NOT MAINTAINED - Via FSC/prometheus path
8. github.com/jackpal/go-nat-pmp - NOT MAINTAINED - Via FSC → libp2p
9. github.com/pbnjay/memory - NOT MAINTAINED - Via FSC → libp2p
10. github.com/remyoudompheng/bigfft - NOT MAINTAINED - Via FSC → sqlite
11. github.com/minio/sha256-simd - NOT MAINTAINED - Via FSC → libp2p
12. github.com/go-logr/stdr - NOT MAINTAINED - Via FSC → OpenTelemetry
13. github.com/kr/text - NOT MAINTAINED - Via FSC/cockroachdb-errors path
14. github.com/kr/pretty - NOT MAINTAINED - Via FSC/cockroachdb-errors path
15. github.com/mitchellh/mapstructure - ARCHIVED - Via FSC → fabric-lib-go
16. github.com/ghodss/yaml - NOT MAINTAINED - Via FSC
17. github.com/davidlazar/go-crypto - NOT MAINTAINED - Via FSC
18. github.com/xeipuuv/gojsonreference - NOT MAINTAINED - Via FSC
19. github.com/xeipuuv/gojsonpointer - NOT MAINTAINED - Via FSC
20. github.com/xeipuuv/gojsonschema - NOT MAINTAINED - Via FSC
21. github.com/Knetic/govaluate - ARCHIVED - Via FSC → Fabric-X

List of issues that addresses the above:

• [DEP] Promote to FSC dependency to v0.13.0 #1806

2. Token SDK Specific (6 dependencies)

These dependencies are present in the Token SDK dependency graph and are more directly actionable by the Token SDK team through dependency upgrades or dependency selection changes.

• 1. github.com/kilic/bls12-381 - ARCHIVED - Via IBM/mathlib
  Addressed under: [DEP]: Addresses unmaintained kilic/bls12-381 dependency used by github.com/IBM/mathlib in regression tests #1814
• 2. github.com/jackc/pgpassfile - NOT MAINTAINED - Via pgx/v5 → pgconn
  Addressed under: [DEP] Addresses unmaintained jackc/pgpassfile dependency used by PostgreSQL #1813
• 3. github.com/sykesm/zap-logfmt - NOT MAINTAINED - Via IBM/idemix / fabric logging path
  Addressed under: [DEP] Addresses unmaintained zap-logfmt dependency used by github.com/IBM/idemix in regression tests #1812
• 4. github.com/go-playground/locales - NOT MAINTAINED - Via validator/v10 path
  Addressed under: [DEP]: Addresses unmaintained go-playground/locales dependency in regression tests #1809
• 5. github.com/go-playground/universal-translator - NOT MAINTAINED - Via validator/v10 path
  Addressed under: [DEP]: Addresses unmaintained go-playground/universal-translator dependency in regression tests #1808
• 6. github.com/hyperledger/aries-bbs-go - ARCHIVED - Via current transitive graph
  Addressed under: [DEP]: Addresses archived aries-bbs-go dependency #1807

3. Common Non-FSC Indirect Dependencies (3 dependencies)

These are generic indirect dependencies retained because this repository directly depends on common parent libraries that still pull them in. They are not FSC-specific, but they also cannot be removed without changing the parent dependencies.

1. github.com/davecgh/go-spew - NOT MAINTAINED - Via github.com/stretchr/testify

2. github.com/pmezard/go-difflib - NOT MAINTAINED - Via github.com/stretchr/testify
   The above two issues addressed under: [DEP] Addresses unmaintained go-spew & go-difflib used by testify #1816

3. github.com/beorn7/perks - NOT MAINTAINED - Via github.com/prometheus/client_golang
   Addressed under: [DEP] Addresses unmainatined beorn7/perks used by prometheus/client_golang #1817