Multiple archived mitchellh/* packages remain in dependency tree

[kotakanbe]

Summary

Several packages by Mitchell Hashimoto remain in Vault's dependency tree after being archived. Two related issues already exist (#29884 for aws-sdk-go v1, #31558 for mapstructure), but the following archived packages have not been reported:

Package	Status	Last Commit	Used In
mitchellh/copystructure	Archived	2021-05	vault/acl.go, vault/policy.go, sdk/logical/request.go, vault/mount.go
mitchellh/go-homedir	Archived	2019-01	api/cliconfig/config.go, api/tokenhelper/, command/base.go etc. (6 files)
mitchellh/reflectwalk	Archived	2020-04	audit/hashstructure.go — audit log hashing

Context

These packages were archived because their functionality is now covered by the Go standard library or by successor packages. They no longer receive bug fixes or security patches.

• copystructure is used for deep-copying ACL parameters (AllowedParameters, DeniedParameters), policy data, and request objects.
• go-homedir is used for ~ expansion in CLI config and token helper paths.
• reflectwalk is used in the audit subsystem to walk and hash sensitive fields in request/response structs.

Suggested replacements

• copystructure → a minimal internal deep-copy helper (~100 lines with reflect). The original is ~300 lines; an LLM can generate a replacement with tests in minutes.
• go-homedir → os.UserHomeDir() (stdlib since Go 1.12). We submitted the same replacement to Trivy: refactor(deps): replace archived go-homedir with os.UserHomeDir aquasecurity/trivy#10484
• reflectwalk → reflect package (stdlib). The walker pattern can be reimplemented with standard reflection.

Related issues

• Switch to AWS SDK v2 before v1 is end-of-support/EOL on July 31, 2025 - Hashicorp Vault #29884 — aws-sdk-go v1 EOL (open since 2025-03)
• please update vault/api/go.mod to use go-viper/mapstructure/v2.4.0 instead of mitchellh/mapstructure v1.5.0 #31558 — mitchellh/mapstructure migration (open)
• api: drop dependency on go-rootcerts #26136 — mitchellh/go-rootcerts removal (open)

How this was detected

Scanned with uzomuzo, an open-source dependency lifecycle scanner.