As of v3.25.0 the github.com/newrelic/go-agent/v3 module has a direct dependency on github.com/valyala/fasthttp.
We have to carefully review third-party libraries. This one in particular is rather concerning due to its use of unsafe.
Judging from the code, it looks like the main module doesn't even need this dependency. It's just so that anyone who happens to use fasthttp can instrument their code. But this should have been isolated to an integration like everything else.
Desired Behavior
The public API of the main module should not include anything outside the Go standard library.
The main module should not include dependencies other than to support its public API and its backing implementation.
Possible Solution
It's a breaking change, so it's tricky. Either just make a breaking change in a minor release and direct people to use the new integration, or release a new major version.
Summary
As of v3.25.0 the github.com/newrelic/go-agent/v3 module has a direct dependency on github.com/valyala/fasthttp.
We have to carefully review third-party libraries. This one in particular is rather concerning due to its use of
unsafe
.Judging from the code, it looks like the main module doesn't even need this dependency. It's just so that anyone who happens to use
fasthttp
can instrument their code. But this should have been isolated to an integration like everything else.Desired Behavior
Possible Solution
It's a breaking change, so it's tricky. Either just make a breaking change in a minor release and direct people to use the new integration, or release a new major version.