Hello Consul maintainers,
During an SBOM/lifecycle compliance scan of Consul 1.22.7, several Go dependencies were reported as archived or end-of-life. Representative findings include:
- github.com/boltdb/bolt
- github.com/coreos/etcd
- github.com/mitchellh/* packages
- github.com/opentracing/opentracing-go
- github.com/google/gofuzz
- github.com/json-iterator/go
- github.com/Azure/go-autorest
- github.com/aws/aws-sdk-go (v1)
- github.com/aliyun/alibaba-cloud-sdk-go
- github.com/envoyproxy/protoc-gen-validate
- k8s.io/* v0.26.x
We reviewed Consul 2.0.x as a possible mitigation, but several of these dependencies still appear in its Go module graph. Updating them locally is generally not sufficient because many of the latest releases are also archived. Replacing them would require API and source-code changes, resulting in a custom Consul fork that would be difficult to maintain and support.
Could you please clarify:
1. Is there an upstream plan to remove or replace these EOL dependencies?
2. Are there target Consul releases or timelines for these migrations?
3. Which dependencies are included in the runtime binary and reachable in production, versus build-time, test-only or unused transitive dependencies?
4. Is there a vendor-supported mitigation for customers with EOL dependency compliance requirements?
5. Can HashiCorp provide a risk assessment, VEX statement or other justification for dependencies that do not affect the deployed Consul runtime?
6. Is upgrading to Consul 2.0.x currently the recommended mitigation, despite some of the same dependencies remaining?
7. Is there an appropriate support channel through which we can arrange a technical discussion with the Consul team?
This request concerns dependency lifecycle and supportability rather than reporting a new vulnerability. We can provide the complete dependency list and sanitized SBOM evidence privately if required.
Thank you.