Signature Equality Is Not Behavioural Equality: Building a Dependency Migrator With Zero Dependencies

说明与用途

molt——一个零依赖工具，通过在 API 兼容时将旧 Go 依赖替换为标准库等价物来减少依赖。

问题

Go projects often keep outdated third‑party dependencies that the standard library now replaces, but removing them safely is hard because API behaviour can differ even when names match.

结果

molt removed dozens of unnecessary dependencies from a sample project, shrinking the go.mod file and eliminating potential API mismatches. The tool demonstrated that static analysis using only the standard library suffices under strict zero‑dependency constraints.

工作流

• 1. Parse each Go file with go/parser (SkipObjectResolution).
• 2. Inspect import declarations and selector expressions to collect referenced exported names.
• 3. Compare each referenced name against a mapping of stdlib replacements and their API signatures.
• 4. If signatures match, rewrite the import path and adjust call sites as needed (e.g., add parentheses for function variables).
• 5. Generate a diff and apply changes.
• 6. Run tests to ensure behaviour remains unchanged.

证据

molt finds the dependencies Go's standard library has already replaced, and rewrites the ones it can prove are safe.

来源

The comparator's return type changed from bool to int. Swap only the import and pass the old closure, and Go's type checker will often accept it — a bool-returning closure is a compile error, but the failure mode people actually hit is subtler.