fix(flagd): update flagd/core and remove vulnerable dependencies [security]

[kuznero]

Summary

• Update github.com/open-feature/flagd/core to v0.13.1/v0.13.2 to address security vulnerabilities
• Remove unused transitive dependencies with known vulnerabilities:
  • github.com/xeipuuv/gojsonpointer
  • github.com/xeipuuv/gojsonreference
  • github.com/xeipuuv/gojsonschema
  • github.com/zeebo/xxh3
  • github.com/klauspost/cpuid/v2
• Adapt InProcess service to handle the new SetState signature that no longer returns change information
• Flag changes are now computed by comparing store state before and after updates

Fixes #814

Additional Changes

• Fix GOBIN path resolution in Makefile to handle multiple GOPATH entries
• Move golang.org/x/exp from direct to indirect dependency in flagd provider
• Improve test cleanup with t.Cleanup and graceful server shutdown
• Update flagd-http-connector to use flagd/core v0.13.2 and Go 1.24.0

Test plan

• Existing tests pass
• Manual verification of in-process provider functionality

[gemini-code-assist]

Summary of Changes

Hello @kuznero, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request primarily focuses on a critical security update for the flagd/core dependency. To accommodate this update, the InProcess service has been refactored to adapt to a change in the SetState function's signature, now requiring manual computation of flag changes. Additionally, several other dependencies have been updated, and minor build and test infrastructure improvements have been made to enhance reliability and maintainability.

Highlights

• Security Update: Updated "github.com/open-feature/flagd/core" to v0.13.1 to address a security vulnerability, ensuring enhanced protection for flag management.
• API Adaptation for InProcess Service: Modified the InProcess service to adapt to a new signature for the SetState function in flagd/core, which no longer returns change information directly. This required internal logic adjustments to maintain functionality.
• Enhanced Flag Change Detection: Implemented a new mechanism within the InProcess service to compute flag changes by comparing the flag store's state before and after updates, ensuring accurate event emission despite the upstream API change.
• Dependency & Tooling Updates: Bumped golangci-lint to v2.7.2 and updated various other Go module dependencies across the project, including golang.org/x/net, google.golang.org/grpc, and OpenTelemetry related modules. Also fixed GOBIN path resolution in the Makefile.
• Test Infrastructure Improvements: Improved test cleanup in service_grpc_test.go by utilizing t.Cleanup for graceful server shutdowns, enhancing test reliability and resource management.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates flagd/core to address a security vulnerability and adapts the code to the new API. The changes are mostly correct, but there are a couple of issues in the new change detection logic: errors are being ignored, and a brittle method is used for comparing flag states. I've provided comments with suggestions to improve robustness and correctness. The test improvements are good.

[kuznero]

/gemini review

[gemini-code-assist]

Code Review

This pull request primarily updates flagd/core to v0.13.1 to address a security vulnerability. The changes correctly adapt the in-process service to the modified SetState signature by implementing a new mechanism to compute flag changes. The logic for change detection is sound, and the test improvements using t.Cleanup and graceful server shutdown are excellent additions for test reliability. I've included a few suggestions to further improve the new change detection logic for better context handling and efficiency.

[kuznero]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates flagd/core to address a security vulnerability and bumps several other dependencies. The changes correctly adapt the in-process service to the new SetState signature from flagd/core. The test suite is also improved with better cleanup logic. My review identifies a logic bug in the new change detection mechanism and suggests improvements for test robustness.

[kuznero]

/gemini review

[gemini-code-assist]

Code Review

This pull request primarily updates Go dependencies across the project, including Go version from 1.24.0 to 1.25.5, golangci-lint version, and various direct and indirect Go module dependencies such as flagd/core, golang.org/x/net, google.golang.org/grpc, and OpenTelemetry packages. The core logic for InProcess service in providers/flagd was refactored to explicitly track flagStore and introduce a new computeChangedFlags function. This function now determines flag changes by comparing old and new flag states using JSON marshalling for deep comparison, replacing the previous evaluator.SetState return values. Test files for the in_process provider were updated to reflect the SetState signature change and to properly manage gRPC server lifecycle with t.Cleanup.

[kuznero]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates flagd/core to v0.13.1 to address a security vulnerability. The code changes correctly adapt the in-process service to the modified SetState API in the new version. Instead of receiving flag changes from SetState, the changes are now computed by comparing the flag store's state before and after the update. The logic for detecting added, modified, and deleted flags is sound. Additionally, the pull request includes valuable improvements to test cleanup and robustness by using t.Cleanup and graceful server shutdowns. The changes are of high quality. I have one suggestion to improve the robustness of the GOBIN path resolution in the Makefile.

[kuznero]

/gemini review

[gemini-code-assist]

Code Review

This pull request primarily updates github.com/open-feature/flagd/core to v0.13.1 to address a security vulnerability. The code changes correctly adapt the in-process service to the new SetState signature, which no longer returns change information. The new logic to compute flag changes by comparing store state before and after updates is sound. Additionally, this PR includes several beneficial improvements, such as bumping golangci-lint, fixing GOBIN path resolution in the Makefile, and enhancing test cleanup with t.Cleanup and graceful server shutdown. Overall, the changes are well-executed. I have one suggestion to improve the maintainability of the new change detection logic.

[kuznero]

/gemini review

[gemini-code-assist]

Code Review

This pull request effectively addresses a security vulnerability by updating github.com/open-feature/flagd/core to v0.13.1. The code changes correctly adapt the in-process service to the modified SetState API by implementing a new mechanism to compute flag changes, comparing the store's state before and after the update. The logic for detecting added, modified, and deleted flags is sound. Additionally, the pull request includes several valuable improvements, such as updating the Go linter, making the Makefile more robust by fixing the GOBIN path resolution, and enhancing test reliability with better cleanup procedures using t.Cleanup and graceful server shutdowns. The code quality is high, and the changes are well-implemented.

[kuznero]

The PR is ready for review by maintainers. Please approve the CI workflow run.

[erka]

@kuznero Thank you for your work.

Unfortunately, CI uses go 1.24 and it will fail for flagd go 1.25.5 requirement. And we have to support go 1.24 until 1.26 is released.

It's better so split all your work into few PRs because golangci-lint runs for all modules in this repo.

[kuznero]

@kuznero Thank you for your work.

Unfortunately, CI uses go 1.24 and it will fail for flagd go 1.25.5 requirement. And we have to support go 1.24 until 1.26 is released.

It's better so split all your work into few PRs because golangci-lint runs for all modules in this repo.

This is a significant blocker. The flagd/core v0.13.1 requires Go 1.25.5:

module github.com/open-feature/flagd/core
go 1.25.5

But the go-sdk-contrib CI requires Go 1.24 compatibility. Is the solution then to try to go to github.com/open-feature/flagd/core and try downgrading Go in there? Please advise.

[kuznero]

@toddbaert , all the fixes for CVEs listed in open-feature/flagd#1840 ... (GHSA-j5pm-7495-qmr3 | GHSA-qh38-484v-w52x | GHSA-7wwx-xj66-r44x | GHSA-hjx7-fpxx-mj48 | GHSA-frhw-mqj2-wxw2 | GHSA-7c64-f9jr-v9h2) are merged into Go 1.24.

[erka]

I'm fine with using that for now, if it's really needed (but I'm not 100% sure all those CVEs are addressed in 1.24.x, I will have to double-check).

Different teams have their own security policies and must handle vulnerabilities according to defined timelines. They may not be able to wait. This also would require people to upgrade to the latest go (1.25.5), which may not be ideal when applying security fixes. @toddbaert

[toddbaert]

I'm fine with using that for now, if it's really needed (but I'm not 100% sure all those CVEs are addressed in 1.24.x, I will have to double-check).

Different teams have their own security policies and must handle vulnerabilities according to defined timelines. They may not be able to wait. This also would require people to upgrade to the latest go (1.25.5), which may not be ideal when applying security fixes. @toddbaert

Fair enough, I'll fix this with 1.24 tomorrow and re-release. Sorry all!

[erka]

@kuznero @connyay Could you please collaborate and focus on a single PR? Having three PRs is a bit much.

[connyay]

I closed mine. Sorry.

[kuznero]

@kuznero @connyay Could you please collaborate and focus on a single PR? Having three PRs is a bit much.

@erka, it should now be ready for another review.

[toddbaert]

I updated to the latest module which works with go 1.24.x, rebased and fixed the (minor) conflicts. I reverted back to Go 1.24 in the consuming modules. Looks good to me. Thanks @kuznero