Fixes sirupsen/logrus#1434 - Update stretchr/testify to v1.9.0 to resolve 2 High sev vulnerabilities
Fixes sirupsen/logrus#1434
I'm not sure where the config for the windows AppVeyor runner is to make the version of GO set to 1.18. The updates here appear to require 1.18 as the minimum version. I've updated all the CI yaml files to use 1.18 as a minimum but still erroring in the windows runner.
One do not change the minimum go version of a project just to fix a vulnerability in a remote dependency which is not even used in the project.
- the "vulnerability" is in
gopkg.in/yaml.v3v3.0.0(fixed inv3.0.1) - logrus uses packages
github.com/stretchr/testify/assertandgithub.com/stretchr/testify/requireONLY in its testsuite -
github.com/stretchr/testify/assertusesgopkg.in/yaml.v3only forYAMLEqandYAMLEqfwhich the logrus testsuite doesn't use -
github.com/stretchr/testifynow has a build tag that allows to stop linking withgopkg.in/yaml.v3See stretchr/testify#1579 (not yet available in a published release, but the build tag can be enabled here right now for a future upgrade).
So this is not at all "2 high severity vulnerabilities". This PR is just FUD and completely useless.
Disclaimer: I'm one Testify co-maintainer.
This was superseded by https://github.com/sirupsen/logrus/pull/1460