build: upgrade anchore dependencies to fix mapstructure compatibility #246
+568
−435
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aledbf
approved these changes
Oct 1, 2025
leodido
changed the base branch from
feature/in-flight-checksums-env-var
to
main
leodido
force-pushed
the
fix/upgrade-anchore-deps-mapstructure
branch
from
31a0be1 to
19ab207
Compare
- Upgrade github.com/anchore/clio to v0.0.0-20250926015255-f418e0b4892c - This brings github.com/anchore/fangs to v0.0.0-20250924221602-895877cb39ec - Fixes compatibility issue between mitchellh/mapstructure and go-viper/mapstructure/v2 - Resolves build failures in cmd package tests due to type mismatch - Updates related dependencies (fsnotify, gookit/color, cobra, etc.) The root cause was that older fangs used mitchellh/mapstructure while newer viper uses go-viper/mapstructure/v2, causing DecoderConfigOption function signature mismatches. The newer fangs version is compatible with the newer mapstructure API. Fixes: cmd package tests now pass, binary builds successfully Co-authored-by: Ona <no-reply@ona.com>
leodido
force-pushed
the
fix/upgrade-anchore-deps-mapstructure
branch
from
19ab207 to
1813aa9
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Upgrades anchore dependencies to resolve a critical compatibility issue between different mapstructure package versions that was preventing the cmd package tests from running.
Root Cause:
anchore/fangs(v0.0.0-20241014225144-4e1713cafd77) usedmitchellh/mapstructure@v1.5.0viper(v1.20.1) usesgo-viper/mapstructure/v2@v2.2.1DecoderConfigOptioncaused build failuresSolution:
anchore/clioto v0.0.0-20250926015255-f418e0b4892canchore/fangsto v0.0.0-20250924221602-895877cb39ecKey Changes:
github.com/anchore/clioupgradedgithub.com/anchore/fangsupgraded (transitive)Related Issue(s)
Fixes cmd package test execution failures with error
cannot use func(dc *mapstructure.DecoderConfig) as viper.DecoderConfigOption.Prerequisite to have tests running in #247.
Hence, it also fixes https://linear.app/ona-team/issue/CLC-1958/leeway-security-testing-suite
How to test
Verify Tests Pass
###Verify Binary Builds
Verify No Regression
Documentation
This is a dependency upgrade that fixes build/test issues without changing user-facing functionality.