Report

A library used by the KEDA operator should be updated to remove any doubt about whether its security defect could affect KEDA.
https://discuss.hashicorp.com/t/hcsec-2024-12-go-retryablehttp-can-leak-basic-auth-credentials-to-log-files/68027

Update github.com/hashicorp/go-retryablehttp to v0.7.7

Expected Behavior

$ git grep go-retryablehttp go.mod
go.mod:   github.com/hashicorp/go-retryablehttp v0.7.5 // indirect

Actual Behavior

$ git grep go-retryablehttp go.mod
go.mod: github.com/hashicorp/go-retryablehttp v0.7.7 // indirect

Steps to Reproduce the Problem

git grep go-retryablehttp go.mod

Logs from KEDA operator

No response

KEDA Version

2.14.0

Kubernetes Version

1.29

Platform

Red Hat OpenShift

Scaler Details

No response

Anything else?

The library in question appears to only be used by the New Relic scaler.