Repository navigation
Switch to urfave/cli/v3 - #1060
Merged
Merged
Conversation
This was referenced May 18, 2026
Open
This is supported and eliminates a number of dependencies.
aelsabbahy
approved these changes
Jun 22, 2026
uk-bolly
added a commit
to uk-bolly/bolly_goss
that referenced
this pull request
Jun 24, 2026
Taken changes and issues from upstream and incorporated Fixed other issues around some integration tests workflow actions updated ### PRs Incorporated - Thanks to [@kgaughan](https://github.com/kgaughan) for authoring the `urfave/cli` v3 migration - [#1060](goss-org/goss#1060) - CLI migrated from `urfave/cli` v1 to `urfave/cli/v3` v3.9.0; v3 is actively maintained and drops transitive dependencies (`go-md2man`, `blackfriday`) - Thanks to [@kgaughan](https://github.com/kgaughan) for restoring clearer `ContainElements` matcher error messages - [#1067](goss-org/goss#1067) - pre-validates array/slice/map types before delegating to gomega, restoring the pre-iterator error text forinvalid inputs (e.g. strings) - Thanks to [@kgaughan](https://github.com/kgaughan) for the dependency and tooling refresh - [#1064](goss-org/goss#1064) - golangci-lint v2.12.2 config (staticcheck settings, `noinlineerr` disabled), dependency bumps (`gomega` v1.41.0, `prometheus/common` v0.68.1), Trivy action updates, and minor lint cleanups; fork already had most workflow, Dockerfile, and code changes at equal or newer versions ### Security - CLI announce output logs resource type and ID only; no longer marshals and prints full resource JSON (fixes CodeQL clear-text logging of password and other sensitive fields) - Health probe debug logging records HTTP status only; no longer logs response body on non-OK status (avoids clear-text logging of password and other sensitive fields from test output) - Health probe content negotiation errors no longer log the raw `Accept` header value from untrusted requests ### Fixed - Integration test `add.goss.yaml` expectations updated for announce output change (resource type and ID only, not full marshaled YAML) - `bullseye` apache2 version bumped to `2.4.67-1~deb11u3` in `vars.yaml` (Debian security update) - Integration test fixtures: removed duplicate `service: apache2` / `service: httpd` definitions between `goss-shared.yaml` and `goss-service.yaml`; eliminates duplicate-key warnings during `validate` in CI ### Added - Multiple `--vars` files supported; vars are merged in flag order with later files overriding overlapping keys; `--vars-inline` still applies last ([#1023](goss-org/goss#1023); thanks to [@Lirt](https://github.com/Lirt) for [PR #1024](goss-org/goss#1024))
uk-bolly
added a commit
to uk-bolly/bolly_goss
that referenced
this pull request
Jun 25, 2026
Taken changes and issues from upstream and incorporated Fixed other issues around some integration tests workflow actions updated ### PRs Incorporated - Thanks to [@kgaughan](https://github.com/kgaughan) for authoring the `urfave/cli` v3 migration - [#1060](goss-org/goss#1060) - CLI migrated from `urfave/cli` v1 to `urfave/cli/v3` v3.9.0; v3 is actively maintained and drops transitive dependencies (`go-md2man`, `blackfriday`) - Thanks to [@kgaughan](https://github.com/kgaughan) for restoring clearer `ContainElements` matcher error messages - [#1067](goss-org/goss#1067) - pre-validates array/slice/map types before delegating to gomega, restoring the pre-iterator error text forinvalid inputs (e.g. strings) - Thanks to [@kgaughan](https://github.com/kgaughan) for the dependency and tooling refresh - [#1064](goss-org/goss#1064) - golangci-lint v2.12.2 config (staticcheck settings, `noinlineerr` disabled), dependency bumps (`gomega` v1.41.0, `prometheus/common` v0.68.1), Trivy action updates, and minor lint cleanups; fork already had most workflow, Dockerfile, and code changes at equal or newer versions ### Security - CLI announce output logs resource type and ID only; no longer marshals and prints full resource JSON (fixes CodeQL clear-text logging of password and other sensitive fields) - Health probe debug logging records HTTP status only; no longer logs response body on non-OK status (avoids clear-text logging of password and other sensitive fields from test output) - Health probe content negotiation errors no longer log the raw `Accept` header value from untrusted requests ### Fixed - Integration test `add.goss.yaml` expectations updated for announce output change (resource type and ID only, not full marshaled YAML) - `bullseye` apache2 version bumped to `2.4.67-1~deb11u3` in `vars.yaml` (Debian security update) - Integration test fixtures: removed duplicate `service: apache2` / `service: httpd` definitions between `goss-shared.yaml` and `goss-service.yaml`; eliminates duplicate-key warnings during `validate` in CI ### Added - Multiple `--vars` files supported; vars are merged in flag order with later files overriding overlapping keys; `--vars-inline` still applies last ([#1023](goss-org/goss#1023); thanks to [@Lirt](https://github.com/Lirt) for [PR #1024](goss-org/goss#1024))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Checklist
make test-all(UNIX) passes. CI will also test thisDescription of change
urfave/cli v1 is currently only receiving security updates, which v3 is under active development. Further, v3 eliminates a number of dependencies, reducing the surface area for CVEs.
A side benefit of urfave/cli v3 is that it supports contexts, so we can look at cleaning up some of goss's internal use of contexts in the future. There are a bunch of places where new contexts are being created where having a single root context created when the program starts would make sense now.
Note: the test suite passes, but there are issues with the integration tests due to the parking of dnstest.io. I have a branch that mostly fixes this, though I haven't yet been able to convince Arch to start up as expected yet.