Repository navigation
build(deps): bump github.com/shopspring/decimal from 1.4.0 to 1.6.0 - #650
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/shopspring/decimal](https://github.com/shopspring/decimal) from 1.4.0 to 1.6.0. - [Release notes](https://github.com/shopspring/decimal/releases) - [Changelog](https://github.com/shopspring/decimal/blob/master/CHANGELOG.md) - [Commits](shopspring/decimal@v1.4.0...v1.6.0) --- updated-dependencies: - dependency-name: github.com/shopspring/decimal dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
leo-aa88
left a comment
leo-aa88
left a comment
There was a problem hiding this comment.
REQUEST CHANGES
This is a 1.4.0 → 1.6.0 jump across two minor releases, and both releases have a "BEHAVIOR CHANGES" section. One of those changes, MaxDecodeExponent in v1.5.0, breaks the database package's tests outright. go.mod/go.sum are consistent (go mod tidy -diff is clean). No pinned version constant for decimal exists anywhere in the repo, and the framework code paths (parseDecimal, types.Decimal decoding) already handle the new decode error by refusing, which is correct. The failure is in a test fixture, and because of it most of the CI matrix never ran.
- BLOCKING:
TestDecimalGuardRefusesUnboundedSizeQuicklypanics onRequireFromString("1e1000000000"). The concrete fix is inline. - MAJOR: 14 jobs (all the real-driver Database, Conformance, Migrations, Fault-injection, Jobs and S3 jobs) were skipped, so the Scan/decode changes are unvalidated.
- MINOR:
types.Decimalnow accepts U+2212 minus, and the size-rule errors depend on the exponent. An upgrade-manifest note is suggested.
VERDICT
This is a test problem, not an implementation problem. The guard's contract ("a hostile exponent is refused without being formatted") still holds on v1.6.0. The test just can no longer build its hostile value with the parser that v1.5.0 hardened. Fix the fixture with decimal.New(...) as shown, then let the full matrix run. Don't merge until it is green.
| github.com/pb33f/libopenapi-validator v0.16.1 | ||
| github.com/redis/go-redis/v9 v9.22.0 | ||
| github.com/shopspring/decimal v1.4.0 | ||
| github.com/shopspring/decimal v1.6.0 |
There was a problem hiding this comment.
1. BLOCKING. The bump breaks database: TestDecimalGuardRefusesUnboundedSizeQuickly panics before it tests anything. (CONFIRMED, database/decimal_test.go:366-393; anchored here because the test file isn't in this diff)
decimal v1.5.0 added MaxDecodeExponent (default 10,000). NewFromString, and with it JSON, text, SQL and gob decoding, now rejects larger exponents. The test builds its hostile values with the parser:
for _, value := range []string{"1e1000000000", "0e1000000000", "-0e999999999", "0e-1000000000"} {
hostile := decimal.RequireFromString(value) // :367On v1.6.0 that is a panic, which is what CI shows:
panic: can't convert 1e1000000000 to decimal: exponent 1000000000 exceeds MaxDecodeExponent (10000)
github.com/gombit-dev/gombit/database.TestDecimalGuardRefusesUnboundedSizeQuickly database/decimal_test.go:367
FAIL github.com/gombit-dev/gombit/database
The panic also hides every test in database that runs after it. The typed-create half of the test (types.Decimal{Decimal: decimal.RequireFromString(value)}, :390) has the same problem.
The guard is fine. It is the fixture that can no longer be built by parsing. Build the values without the parser, so they still reach DecimalStorageProblem and the write-path guard. Values with exponents this large can still exist in memory (from arithmetic or decimal.New), so the test still pins a real contract:
for _, h := range []struct {
value string
d decimal.Decimal
}{
{"1e1000000000", decimal.New(1, 1000000000)},
{"0e1000000000", decimal.New(0, 1000000000)},
{"-0e999999999", decimal.New(0, 999999999)},
{"0e-1000000000", decimal.New(0, -1000000000)},
} {
value, hostile := h.value, h.dDo the same for the second loop, and use types.Decimal{Decimal: h.d} at :390. Keep Update("amount", value) with the string: that path now fails in parseDecimal's NewFromString and still has to come back as a *ValidationError. I applied exactly this change locally on this head, and go test ./database (sqlite) passes on decimal v1.6.0.
This is the same class of breakage as gombit-forge #224's pinned-decimal fix. The test hard-codes an assumption about what the dependency's parser accepts.
| github.com/pb33f/libopenapi-validator v0.16.1 | ||
| github.com/redis/go-redis/v9 v9.22.0 | ||
| github.com/shopspring/decimal v1.4.0 | ||
| github.com/shopspring/decimal v1.6.0 |
There was a problem hiding this comment.
2. MAJOR. Most of the CI matrix never ran on this bump. Test failed, so 14 jobs were skipped: Database (sqlite/postgres/mysql), Conformance ×3, Migrations ×3, Fault injection 1-6, Jobs (redis), Storage (s3) and Benchmark smoke. "Fault injection" is only the aggregator that reports the skips. v1.5/v1.6 change Scan (float32 now goes through NewFromFloat32; NULL gets a new error), UnmarshalBinary, and the MaxDecodeExponent limit on every SQL decode. The real-driver jobs are the ones that would catch a scan regression on MySQL DECIMAL(65,30) or PostgreSQL numeric. Nothing has exercised them here. After the fix in (1), the full matrix has to go green before this can merge.
| github.com/pb33f/libopenapi-validator v0.16.1 | ||
| github.com/redis/go-redis/v9 v9.22.0 | ||
| github.com/shopspring/decimal v1.4.0 | ||
| github.com/shopspring/decimal v1.6.0 |
There was a problem hiding this comment.
3. MINOR. Two quiet changes to types.Decimal's accepted input and its errors. (CONFIRMED with a probe against v1.6.0)
- v1.6.0's
NewFromStringaccepts the Unicode minus−(U+2212).types.Decimal.UnmarshalJSON,UnmarshalTextandScanall delegate to shopspring first. On this head,json.Unmarshal([]byte("−5"), &d)gives-5, nil, and on v1.4.0 it was an error.DecimalPattern(^-?[0-9]+(\.[0-9]+)?$) still advertises ASCII only. The parser was already wider than the pattern ("1e5", ".5"), so this widens an existing gap rather than opening a new one. Still, any path that skips huma's schema check (job payloads,UnmarshalTextfrom config/query, admin'sparseDecimalValueinadmin/convert.go:135) now accepts a spelling it didn't accept before. - The size-rule errors now depend on the exponent.
"1e5000"→decimal has more than 1000 digits(gombit's rule), but"1e50000"→error decoding string '"1e50000"': can't convert 1e50000 to decimal: exponent 50000 exceeds MaxDecodeExponent (10000). That second error leaks a shopspring setting name, because shopspring now refuses beforecheckSpelledDecimalruns. Both are still refused. Only the message changes.
Neither blocks the bump. types.Decimal embeds decimal.Decimal in the public API, so apps inherit all of v1.5/v1.6's BEHAVIOR CHANGES through MVS: RoundUp/Down/Ceil/Floor exponents, Pow/Ln results, %#v/%d formatting, and Truncate with negative precision. That's worth an informational kind: dependency entry in upgrade/manifest.yaml, like aws-sdk-updates.
Bumps github.com/shopspring/decimal from 1.4.0 to 1.6.0.
Release notes
Sourced from github.com/shopspring/decimal's releases.
Changelog
Sourced from github.com/shopspring/decimal's changelog.
... (truncated)
Commits
447b833docs: changelog for v1.6.0 (#477)4ce352ffix: reject overflowing division precision (#472)540b915docs: add udecimal to the alternative libraries (#476)5474883docs: show how to control the JSON format of one field (#475)ddb96d1fix: clearer error when scanning NULL into a Decimal (#474)59f775dREADME: Fix URLs for the official Go pages (#264)100aebffeat: add Root and RootRound (#473)bed77f5fix: Ln rounds correctly, computed with error bounds like Pow (#471)37aad64feat: add NewFromBigFloat constructor (#457)78a38f8perf: NewFromFloat uses strconv, drop the vendored strconv copy (#431)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)