[ARROW-16759] [Go] Update testify to fix securiy vulnerability

• Type: Task
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 7.0.0, 8.0.0
• Fix Version/s: 6.0.2, 7.0.1, 8.0.1, 9.0.0
• Component/s: Go
• Labels: pull-request-available
• Flags: Patch
• External issue URL: https://github.com/apache/arrow/issues/32093
• Assignee: Dominic Barnes
• Reporter: Dominic Barnes
• Created: 06/Jun/22 21:28
• Updated: 11/Jan/23 11:46
• Resolved: 10/Jun/22 14:16

Description

The packges under github.com/apache/arrow/go currently have a dependency on github.com/stretchr/testify v1.7.0 which has a dependency on gopkg.in/yaml.v3 that has an outstanding security vulnerability. (CVE-2022-28948)

While testify is only used during tests, this is not distinguished by the go toolchain and other tools like Snyk which scan the dependency chain for vulnerabilities. Unfortunately, due to Go's Minimal version selection this ends up requiring us to visit our dependencies to ensure this security vulnerability is addressed.

Issue Links

• links to: GitHub Pull Request #13322
• links to: GitHub Pull Request #13586
• links to: GitHub Pull Request #13587
• links to: GitHub Pull Request #13588
• links to: GitHub Pull Request #13606