Replacement for Gorilla/MUX package

[tsconn23]

🚀 Feature Request

The maintainer of the gorilla/mux package is retiring and looking for a new maintainer. Thus EdgeX should look into replacing or decoupling from the package or taking on some maintenance if appropriate.

Relevant Package [REQUIRED]

This feature request is for... Affected package = gorilla/mux ALL of the EdgeX microservices have a dependency on it ### Description [**REQUIRED**] Please see here: https://github.com/gorilla/mux/issues/659 ### Describe the solution you'd like I'm not sure if this has been discussed in the project Slack channel as I can't access it anymore. But I didn't see an issue or PR about it and I wanted to be sure the project was aware. ### Describe alternatives you've considered Have you considered any alternative solutions or workarounds? No. This is in the interest of raising a flag. If you're already aware and planning an approach, feel free to close.

[cloudxxx8]

thanks, @tsconn23 , we didn't notice that. I will bring this topic to the working group meeting.

[bnevis-i]

Possible replacements, taken from https://github.com/MadAppGang/httplog

• alice
• chi
• echo
• gin
• goji
• httprouter
• mojito
• negroni
• native net/http

[oherych]

Good morning. I have had a chance to test most of those HTTP routes.

First of I down recommend using a native HTTP router in production. I was excellent at the start of Golang life. But right now we have better alternatives.

I the context of this project I definitely recommend to use Echo. It has a good balance of performance and usability. Good customization and flexibility.

Gin is more popular, has a bigger community, and has a big list of middleware. But unfortunately, it has architecture and error-handling problems. The last argument is the source of many problems.

So, Echo is best in this case.

[bnevis-i]

Quick read on echo is showing a favorable license (MIT), active contributors, lots of stars, and a pull request backlog that is under control, and a history of CVEs being filed against it (though not self-reported by the project.) [generally regarded as a good thing that security researchers are scrutinizing it]

[farshidtz]

I just noticed that the Gorilla project has become active again since last month; see https://github.com/gorilla/mux/commit/7456b4e9ae7b67e27ffaa2e497941e77d39bc884 There are no new releases yet, but looks like they have found a new maintainer.

[cloudxxx8]

@jumpingliu please add this to the Core WG agenda, and we will discuss whether we should revert the recent changes.

[jumpingliu]

@cloudxxx8 ok, added