deps: bump go-retryablehttp to v0.7.7 #499
Conversation
There was a problem hiding this comment.
Thanks for the PR! I left a comment on bumping the minimum go version, I would suggest we don't to avoid anyone developing the plugin having to install a more recent version of the go toolchain for local development.
On another note, for curiosity purposes, why are we bumping the go-version here? I understand that retryablehttp gets bumped to address the linked CVE, but it seems that they are still requiring go 1.19 in their modfile, so this looks unrelated; not against the idea of building the plugin with a newer version to be clear, just want to understand the rationale here.
Other than that, LGTM!
dduzgun-security
changed the title
|
@lbajolet-hashicorp it seems like I don't have the GitHub permissions to merge. 😄 |
|
Yessir, I was waiting for the tests to go green, doing this now :) |
Bump go-retryablehttp to v0.7.7 to resolve https://github.com/hashicorp/packer-plugin-amazon/security/dependabot/30