Question: depguard v1 default behavior

[Piotr Persona]

Hi

I recently updated golangci-lint to v1.53.0 and it seems to get latest depguard v2.
Before I was running depguard without any config, however now I need to explicitly list all allowed packages in order to pass the lint.

I would like to ask what was the previous behavior of depguard in version v1 without config?

[Agus Luques]

+1

[Will Dixon]

According to the following links, the linter "ran" but did absolutely nothing.

https://github.com/golangci/golangci-lint/blob/da04413a8a1eefb8c10161c9f2b558138d01815c/pkg/golinters/depguard.go#L191
https://github.com/OpenPeeDeeP/depguard/blob/d0d01fdcd8a55c8fcde2d55546d721d2290e02dc/depguard.go#LL73C1-L76C3

But according to https://golangci-lint.run/usage/linters/ depguard isn't enabled by default. So I assume you must have enabled it not realizing that it did nothing without configuring it.

Now, if enabled, the default behavior is to only allow Golang Standard Library.

https://github.com/OpenPeeDeeP/depguard/blob/5113310597520b31601e7378530c8001d1eec23f/settings.go#L134-#L144

I suggest either disabling it in golangci-lint or configure it according to https://github.com/golangci/golangci-lint/blob/68be5babba5cde7cde558e87fb993b484cd48cc0/.golangci.reference.yml#LL173C1-L205C68

[Piotr Persona]

Thank you @dixonwille for the response. I didn't realise, that linter was enabled and doing nothing.

[Eric Jain]

depguard v1 worked great for catching use of blacklisted packages; going to have to disable it now since listing every single internal (!) and external package is way too cumbersome.

[Will Dixon]

@ejain

Have you tried removing the AllowList (if nothing in allow, assumes all packages are fine) then just adding the packages you don't want to the DenyList. Also, github,.com/OpenPeeDeeP/ will match any package in the OpenPeeDeeP org because of path prefixing (and the reverse !github.com/OpenPeeDeeP/ will matche every package that is not in OpenPeeDeeP org).

https://github.com/OpenPeeDeeP/depguard/blob/6a315f2326b2084d60c0a056bcafa10d1e9f5bd7/settings_test.go#LL473C1-L549C2

[Eric Jain]

@dixonwille Here's the relevant section from my .golangci.yml, not specifying "allow":

linters-settings:
  depguard:
    deny:
      - pkg: encoding/json
        desc: "use pkg/json"

Also, path prefixing doesn't seem to work, need to specify the full package names.

linters-settings:
  depguard:
    allow:
      - github.com/foo/bar/ # doesn't allow github.com/foo/bar/baz

Could be a problem with the golangci-lint integration, too.

[Will Dixon]

I'll check into it

Just so I am clear though, there appears to be a few levels missing in your yaml (rules and rulset name)... did you exclude for brevity?

https://github.com/golangci/golangci-lint/blob/829af927217a21ea5483757d4c1f7bbbfa30a032/.golangci.reference.yml#LL173C3-L205C68

[Eric Jain]

Oh, my bad, works as expected after adding the missing levels 🫢