chore(deps): Track deprecated indirect dependencies

[abtreece]

Summary

Several indirect dependencies are deprecated or archived. These are pulled in by upstream packages (etcd, consul, grpc) and cannot be directly removed. This issue tracks them for awareness and monitoring.

Deprecated Indirect Dependencies

Package	Status	Pulled In By
github.com/gogo/protobuf	Deprecated/Archived	go.etcd.io/etcd/client/v3
github.com/golang/protobuf	Deprecated	go.etcd.io/etcd/client/v3, google.golang.org/grpc
github.com/mitchellh/mapstructure	Archived (July 2024)	github.com/hashicorp/consul/api

Why We Can't Remove Them

$ go mod why github.com/mitchellh/mapstructure
github.com/abtreece/confd/pkg/backends/consul
github.com/hashicorp/consul/api
github.com/mitchellh/mapstructure

These are transitive dependencies from our backend clients.

Upstream Tracking

• etcd: The etcd team is aware of the gogo/protobuf deprecation. The client v3.6.x still uses it.
• consul: HashiCorp consul/api uses mapstructure. The go-viper/mapstructure fork exists but consul hasn't migrated yet.
• grpc: grpc-go uses golang/protobuf for compatibility but internally uses google.golang.org/protobuf.

Action Items

• Monitor etcd releases for protobuf migration
• Monitor consul/api releases for mapstructure migration
• Update upstream dependencies when migrations are complete
• Periodically run go mod tidy and check for security advisories

Priority

Low - These are indirect dependencies we cannot control. Monitor upstream projects.

References

• https://github.com/gogo/protobuf (deprecated)
• https://github.com/golang/protobuf (deprecated, use google.golang.org/protobuf)
• https://github.com/mitchellh/mapstructure (archived)
• https://github.com/go-viper/mapstructure (maintained fork)
• Remove gogo protobuf dependency for Kubernetes API types kubernetes/enhancements#5589 (K8s tracking gogo removal)

[abtreece]

@claude begin working on this migration. commit all changes to a new branch and PR when it's ready for review

[abtreece]

Dependency Update Status (January 2026)

Progress Made

PR #377 updates consul/api from v1.31.2 to v1.33.0, which uses go-viper/mapstructure/v2 instead of the archived mitchellh/mapstructure.

Current Dependency Status

Package	Status	Required By	Notes
mitchellh/mapstructure	Still present	hashicorp/vault/api	Consul migrated, Vault hasn't
gogo/protobuf	Still present	go.etcd.io/etcd/client/v3	etcd v3.6 still uses it
golang/protobuf	Still present	go.etcd.io/etcd/client/v3	etcd v3.6 still uses it

Upstream Status

• Consul: ✅ Migrated to go-viper/mapstructure in v1.21.5 (September 2025)
• Vault: ❌ Still using mitchellh/mapstructure in v1.22.0 (latest)
• etcd: ❌ Still using gogo/protobuf in v3.6.x - migration ongoing per etcd issue #14533

Recommendations

1. Merge PR chore(deps): Update consul/api to v1.33.0 #377 to get consul/api update
2. Monitor hashicorp/vault/api releases for mapstructure migration
3. Monitor etcd releases for protobuf migration (likely v3.7+)
4. Continue periodic dependency audits

Sources:

• Consul v1.21.5 Release
• etcd v3.6.0 Announcement

[abtreece]

Dependency Status Check (January 2026)

Current Versions (All at Latest)

Package	Current	Latest
hashicorp/vault/api	v1.22.0	v1.22.0 ✓
go.etcd.io/etcd/client/v3	v3.6.7	v3.6.7 ✓

Dependency Chain Verification

$ go mod why -m github.com/mitchellh/mapstructure
github.com/abtreece/confd/pkg/backends/vault
github.com/hashicorp/vault/api
github.com/mitchellh/mapstructure

$ go mod why -m github.com/gogo/protobuf
github.com/abtreece/confd/pkg/backends/etcd
go.etcd.io/etcd/client/v3
go.etcd.io/etcd/api/v3/authpb
github.com/gogo/protobuf/gogoproto

$ go mod why -m github.com/golang/protobuf
github.com/abtreece/confd/pkg/backends/etcd
go.etcd.io/etcd/client/v3
go.etcd.io/etcd/api/v3/authpb
github.com/golang/protobuf/proto

Upstream Migration Status

Vault (mitchellh/mapstructure):

• Open issue: hashicorp/vault#31558 (September 2025)
• No migration in v1.22.0
• Security note: HCSEC-2025-09 identified mapstructure-related vulnerability

etcd (gogo/protobuf, golang/protobuf):

• Tracking issue: etcd-io/etcd#14533
• v3.6.x still uses gogo/protobuf
• v3.7 in draft status, expected to address this

Action

No updates available. Continue monitoring upstream releases.