refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)

Co-authored-by: knqyf263 <knqyf263@users.noreply.github.com> Co-authored-by: nikpivkin <nikita.pivkin@smartforce.io>
2025-12-05 20:40:16 -08:00 · 2025-09-15 12:46:44 +04:00
parent 1ff9ac7948
commit 788f6faffb
18 changed files with 40 additions and 34 deletions
--- a/.github/workflows/cache-test-assets.yaml
+++ b/.github/workflows/cache-test-assets.yaml
@@ -92,5 +92,7 @@ jobs:
      - name: Run golangci-lint for caching
        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
        with:
-          version: v2.1
+          version: v2.4
          args: --verbose
+        env:
+          GOEXPERIMENT: jsonv2
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -40,9 +40,11 @@ jobs:
        id: lint
        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
        with:
-          version: v2.1
+          version: v2.4
          args: --verbose
          skip-save-cache: true  # Restore cache from main branch but don't save new cache
+        env:
+          GOEXPERIMENT: jsonv2
        if: matrix.operating-system == 'ubuntu-latest'

      - name: Check if linter failed
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -193,7 +193,7 @@ linters:
    warn-unused: true

 run:
-  go: '1.24'
+  go: '1.25'
  timeout: 30m

 formatters:
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/aquasecurity/trivy

-go 1.24.7
+go 1.25

 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.0
@@ -47,7 +47,6 @@ require (
 	github.com/docker/go-units v0.5.0
 	github.com/fatih/color v1.18.0
 	github.com/go-git/go-git/v5 v5.16.2
-	github.com/go-json-experiment/json v0.0.0-20250223041408-d3c622f1b874 // Replace with encoding/json/v2 when proposal is accepted. Track https://github.com/golang/go/issues/71497
 	github.com/go-redis/redis/v8 v8.11.5
 	github.com/gocsaf/csaf/v3 v3.3.0
 	github.com/golang-jwt/jwt/v5 v5.3.0
--- a/go.sum
+++ b/go.sum
@@ -1176,8 +1176,6 @@ github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7
 github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
 github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
-github.com/go-json-experiment/json v0.0.0-20250223041408-d3c622f1b874 h1:F8d1AJ6M9UQCavhwmO6ZsrYLfG8zVFWfEfMS2MXPkSY=
-github.com/go-json-experiment/json v0.0.0-20250223041408-d3c622f1b874/go.mod h1:TiCD2a1pcmjd7YnhGH0f/zKNcCD06B029pHhzV23c2M=
 github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
 github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81/go.mod h1:SX0U8uGpxhq9o2S/CELCSUxEWWAuoCUcVCQWv7G2OCk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
--- a/goreleaser-canary.yml
+++ b/goreleaser-canary.yml
@@ -11,6 +11,7 @@ builds:
      - -X github.com/aquasecurity/trivy/pkg/version/app.ver={{.Version}}
    env:
      - CGO_ENABLED=0
+      - GOEXPERIMENT=jsonv2
    goos:
      - darwin
      - linux
--- a/goreleaser.yml
+++ b/goreleaser.yml
@@ -11,6 +11,7 @@ builds:
      - -X github.com/aquasecurity/trivy/pkg/version/app.ver={{.Version}}
    env:
      - CGO_ENABLED=0
+      - GOEXPERIMENT=jsonv2
    goos:
      - linux
    goarch:
@@ -31,6 +32,7 @@ builds:
      - -X github.com/aquasecurity/trivy/pkg/version/app.ver={{.Version}}
    env:
      - CGO_ENABLED=0
+      - GOEXPERIMENT=jsonv2
    goos:
      - freebsd
    goarch:
@@ -47,6 +49,7 @@ builds:
      - -X github.com/aquasecurity/trivy/pkg/version/app.ver={{.Version}}
    env:
      - CGO_ENABLED=0
+      - GOEXPERIMENT=jsonv2
    goos:
      - darwin
    goarch:
@@ -63,6 +66,7 @@ builds:
      - -X github.com/aquasecurity/trivy/pkg/version/app.ver={{.Version}}
    env:
      - CGO_ENABLED=0
+      - GOEXPERIMENT=jsonv2
    goos:
      - windows
    goarch:
--- a/magefiles/magefile.go
+++ b/magefiles/magefile.go
@@ -28,7 +28,8 @@ var (
 	GOBIN  = filepath.Join(GOPATH, "bin")

 	ENV = map[string]string{
-		"CGO_ENABLED": "0",
+		"CGO_ENABLED":  "0",
+		"GOEXPERIMENT": "jsonv2",
 	}
 )

@@ -73,7 +74,7 @@ func (Tool) PipTools() error {

 // GolangciLint installs golangci-lint
 func (t Tool) GolangciLint() error {
-	const version = "v2.1.2"
+	const version = "v2.4.0"
 	bin := filepath.Join(GOBIN, "golangci-lint")
 	if exists(bin) && t.matchGolangciLintVersion(bin, version) {
 		return nil
@@ -341,19 +342,19 @@ type Lint mg.Namespace
 // Run runs linters
 func (l Lint) Run() error {
 	mg.Deps(Tool{}.GolangciLint, Tool{}.Install)
-	if err := sh.RunV("golangci-lint", "run", "--build-tags=integration"); err != nil {
+	if err := sh.RunWithV(ENV, "golangci-lint", "run", "--build-tags=integration"); err != nil {
 		return err
 	}
-	return sh.RunV("modernize", "./...")
+	return sh.RunWithV(ENV, "modernize", "./...")
 }

 // Fix auto fixes linters
 func (l Lint) Fix() error {
 	mg.Deps(Tool{}.GolangciLint, Tool{}.Install)
-	if err := sh.RunV("golangci-lint", "run", "--fix", "--build-tags=integration"); err != nil {
+	if err := sh.RunWithV(ENV, "golangci-lint", "run", "--fix", "--build-tags=integration"); err != nil {
 		return err
 	}
-	return sh.RunV("modernize", "-fix", "./...")
+	return sh.RunWithV(ENV, "modernize", "-fix", "./...")
 }

 // Fmt formats Go code
--- a/pkg/dependency/parser/c/conan/parse.go
+++ b/pkg/dependency/parser/c/conan/parse.go
@@ -1,11 +1,11 @@
 package conan

 import (
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"slices"
 	"strings"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"github.com/samber/lo"
 	"golang.org/x/xerrors"

--- a/pkg/dependency/parser/nodejs/bun/parse.go
+++ b/pkg/dependency/parser/nodejs/bun/parse.go
@@ -1,13 +1,13 @@
 package bun

 import (
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"fmt"
 	"io"
 	"sort"
 	"strings"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"github.com/samber/lo"
 	"golang.org/x/xerrors"

--- a/pkg/iac/scanners/azure/arm/parser/template.go
+++ b/pkg/iac/scanners/azure/arm/parser/template.go
@@ -2,15 +2,14 @@ package parser

 import (
 	"bytes"
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"fmt"
 	"io/fs"
 	"iter"
 	"strconv"
 	"strings"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
-
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
 	"github.com/aquasecurity/trivy/pkg/iac/scanners/azure"
 	"github.com/aquasecurity/trivy/pkg/iac/scanners/azure/resolver"
--- a/pkg/iac/scanners/azure/value.go
+++ b/pkg/iac/scanners/azure/value.go
@@ -1,14 +1,14 @@
 package azure

 import (
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"fmt"
 	"maps"
 	"slices"
 	"strings"
 	"time"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"github.com/samber/lo"

 	"github.com/aquasecurity/trivy/pkg/iac/types"
--- a/pkg/iac/scanners/cloudformation/parser/parameter.go
+++ b/pkg/iac/scanners/cloudformation/parser/parameter.go
@@ -1,6 +1,8 @@
 package parser

 import (
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"errors"
 	"fmt"
 	"io"
@@ -8,8 +10,6 @@ import (
 	"strconv"
 	"strings"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"gopkg.in/yaml.v3"

 	"github.com/aquasecurity/trivy/pkg/iac/scanners/cloudformation/cftypes"
--- a/pkg/iac/scanners/cloudformation/parser/property.go
+++ b/pkg/iac/scanners/cloudformation/parser/property.go
@@ -1,14 +1,14 @@
 package parser

 import (
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"fmt"
 	"io/fs"
 	"reflect"
 	"strconv"
 	"strings"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"gopkg.in/yaml.v3"

 	"github.com/aquasecurity/trivy/pkg/iac/scanners/cloudformation/cftypes"
--- a/pkg/iac/scanners/cloudformation/parser/resource.go
+++ b/pkg/iac/scanners/cloudformation/parser/resource.go
@@ -1,11 +1,11 @@
 package parser

 import (
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"io/fs"
 	"strings"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"gopkg.in/yaml.v3"

 	iacTypes "github.com/aquasecurity/trivy/pkg/iac/types"
--- a/pkg/iac/scanners/kubernetes/parser/manifest_node.go
+++ b/pkg/iac/scanners/kubernetes/parser/manifest_node.go
@@ -2,13 +2,13 @@ package parser

 import (
 	"encoding/base64"
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"fmt"
 	"reflect"
 	"strconv"
 	"time"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"gopkg.in/yaml.v3"

 	"github.com/aquasecurity/trivy/pkg/log"
--- a/pkg/x/json/json.go
+++ b/pkg/x/json/json.go
@@ -2,10 +2,10 @@ package json

 import (
 	"bytes"
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"io"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"golang.org/x/xerrors"

 	"github.com/aquasecurity/trivy/pkg/fanal/types"
--- a/pkg/x/json/json_test.go
+++ b/pkg/x/json/json_test.go
@@ -1,10 +1,10 @@
 package json_test

 import (
+	"encoding/json/jsontext"
+	"encoding/json/v2"
 	"testing"

-	"github.com/go-json-experiment/json"
-	"github.com/go-json-experiment/json/jsontext"
 	"github.com/stretchr/testify/require"

 	xjson "github.com/aquasecurity/trivy/pkg/x/json"