Replace 'request' with 'require' in go.mod to allow downstream fix.

[mishas]

Fixes #47

[mishas]

@fergusstrange , FYI.

[fergusstrange]

Hmmm I think the way these vulnerability scanners work is that they scan the go.sum for references to the package versions with the CVE present. I'm pretty sure this is going to make it break again if there is still reference to github.com/ulikunitz/xz v0.5.6.

Can you investigate a little and find out?

Thanks @mishas

[mishas]

The way Go works, is it's taking the largest version (that's still considered to be backward compatible) from the go.sum file.
If the vulnerability scanner is any good, it should do the same...

I can only speak towards Dependabot (the Github built-in solution), which is what I'm using, and it will works correctly.
No idea what others are using, and how that will stack up to the challenge.

[fergusstrange]

Hey @mishas,

It's been something I've been meaning to do for a while anyway so have started on the task this evening of removing the actual majority of the archiver dependencies, which would include xz anyway.

If you're desperate for the above change we can work this one through but I think I should be able to get a release of the removal in the next few days out for you.

If you'd like to contribute to the code or review you can find here #50. It's almost there but will need some eyes on it and some new coverage.

Thanks

[mishas]

Hey @fergusstrange ,

I'm not desperate about the above change, I just made it because I thought the previous change (#42) was incorrect, and wanted to fix it.

Feel free to close this PR, and I'll look into reviewing #50.

Thanks.