fix: remove go-fiber and fileserver plugin - #2210
Conversation
Signed-off-by: Valery Piashchynski <piashchynski.valery@gmail.com>
WalkthroughThe changes remove the fileserver plugin from the plugin registry and its related import. Additionally, the Go module file ( Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~7 minutes Suggested labels
Suggested reviewers
Poem
Note 🔌 MCP (Model Context Protocol) integration is now available in Early Access!Pro users can now connect to remote MCP servers under the Integrations page to get reviews and chat conversations that understand additional development context. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR removes the go-fiber dependency and fileserver plugin from the RoadRunner server due to security concerns. The fileserver plugin, which was the only component using go-fiber, has been removed to eliminate the CVE vulnerabilities associated with the go-fiber library.
- Removes the fileserver plugin from the plugin list and dependencies
- Updates Go toolchain and various dependency versions
- Eliminates go-fiber related dependencies (valyala/fasthttp, valyala/bytebufferpool, gofiber/fiber/v2, andybalholm/brotli)
Reviewed Changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| go.mod | Removes fileserver dependency and updates Go version, toolchain, and various indirect dependencies |
| container/plugins.go | Removes fileserver plugin import and registration from the plugin container |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (2)
go.mod (2)
12-57: Remove leftover Fileserver references in configuration schemas and.rr.yamlThe grep results show that the Fileserver plugin is still referenced in your config schemas and the default
.rr.yaml. These should be removed to fully eliminate the dependency:• schemas/config/3.0.schema.json: lines 28–29
• schemas/config/2.0.schema.json: line 1903
• .rr.yaml: lines 1999–2000Please delete or update those entries so that no “fileserver” key or schema
$refremains. Afterward, run:go mod tidyto clean up any unused module requirements and ensure your bundle’s dependency graph is minimal.
1-220: Removefileserverreferences in JSON schemasThe schema files still reference the removed fileserver plugin. Please remove or update these entries to point users toward the static plugin or a Velox-built fileserver:
• schemas/config/2.0.schema.json (around line 1903): remove the entire
"fileserver": { … }block.
• schemas/config/3.0.schema.json (lines 28–29): remove or replace the$reftohttps://raw.githubusercontent.com/roadrunner-server/fileserver/…/schema.json.Afterward, verify that no other docs or examples reference “fileserver.” If helpful, I can draft a short migration snippet guiding users to the static plugin or custom Velox build.
🧹 Nitpick comments (1)
go.mod (1)
157-160: Pre-release pseudo-version for sourcegraph/conc; use a stable tag if reproducibility is a concernYou’re on
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8(pseudo-version). If this wasn’t deliberate, prefer a stable tag (e.g.,v0.3.0) to reduce churn from transitive updates.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (2)
container/plugins.go(0 hunks)go.mod(5 hunks)
💤 Files with no reviewable changes (1)
- container/plugins.go
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Golang-CI (lint)
- GitHub Check: Unit tests
- GitHub Check: Analyze (go)
🔇 Additional comments (4)
go.mod (4)
203-217: Large bumps of golang.org/x/ and google.golang.org/*; watch for subtle API shifts*Patch/minor bumps here can surface lints or deprecations in x/*, grpc/genproto, and protobuf.
Please ensure CI runs vet/lint consistently after this change (no action needed if your pipeline already gates on these).
12-12: Minor bump tablewriter to v1.0.9 looks safeThis is a patch-level upgrade with no breaking API changes expected.
65-87: Pub/Sub v2 import usage verified as absentA search across all
.gofiles found no imports ofcloud.google.com/go/pubsub/v2—both v1 and v2 only appear as indirect entries ingo.mod/go.sum. You can safely leave them (they’re pulled in by transitive deps) or remove the unused v2 entry by running:go mod tidy
3-5: CI and Dockerfile Go versions already align with go.mod
All workflows use actions/setup-go@v5 withgo-version: stable, and the Dockerfile is based ongolang:1.24-alpine—both track the latest 1.24 patch (currently 1.24.6). No mismatches detected.• If you have any README or other local dev docs that pin a specific Go version, update them to reflect the current patch release.
Reason for This PR
fileserver. The plugin has been removed and is now available to be built with Velox.Description of Changes
License Acceptance
By submitting this pull request, I confirm that my contribution is made under the terms of the MIT license.
PR Checklist
[Author TODO: Meet these criteria.][Reviewer TODO: Verify that these criteria are met. Request changes if not]git commit -s).CHANGELOG.md.Summary by CodeRabbit