What are the chances viper 1.x can use a 2.x version of hashicorp/hcl?

[stevesim101]

Our company's SCA tool is flagging github.com/hashicorp/hcl v1.0.0 with a license violation and, as a result, is blocking my ability to use viper v1.8.1

Is there any chance viper 1.x would be able to use a newer version of the hcl package (since the 2.x family is not blocked due to license violations)? Wasn't sure if an hcl upgrade would introduce breaking changes to viper 1.x?

If an hcl package upgrade is not possible with viper 1.x, does anyone know if viper 2 will use a newer version of the package?

[sagikazarmark]

Hi @stevesim101 !

I've been reluctant to upgrade to HCL 2, because it brings in quite a few dependencies to the dependency graph only used in their CLI tools, but not in the library itself.

Viper 2 will most probably drop HCL as a builtin format, because
a) research shows that it's rarely used
b) it's actually full of bugs

As for Viper 1, I'd like to avoid upgrading if possible, but there will be a couple solutions to use HCL 2 instead of HCL 1: the encoding layer is currently being rebuilt in the background in a backwards compatible way. We can probably come up with a solution that either allows replacing the HCL implementation or disabling it all together (eg. using build tags).

The package would still show up as a dependency, but from that point, it'd be a false positive check since HCL 1 would not be used from that point.

Would either of these solutions help you?

[stevesim101]

Thanks for getting back to me. If Viper 2 drops HCL, that certainly wouldn't impact me. You've got my vote on that decision.

As far as Viper 1, I would be far more successful if it didn't contain any traces to HCL 1. Even false positive checks with my SCA platform are a major headache for my team. Not sure if I'm understanding the options correctly, but it sounds like you're saying you could use HCL 2 instead of HCL 1 in VIper 1. Is that correct?

[sagikazarmark]

Yes, we could theoretically use HCL 2, but it would introduce a major dependency hell (since HCL 2 itself depends on Cobra as well), so until that changes, I'd like to avoid pulling it in.

Let me see if I can find a way.

[stevesim101]

I appreciate your help on this. Certainly don't want to create a dependency nightmare for you.