[MehdiZare]

Related Issue

Dependency maintenance based on published Go advisories; no separate issue.

Description

The latest published provider binary produced 13 advisory matches in govulncheck v1.9.0 -mode=binary. These are binary-symbol matches, not a claim that every advisory is exploitable through provider operations.

This updates the build toolchain and affected modules, and adds a binary scan for Linux AMD64 and macOS ARM64. Both rebuilt targets report No vulnerabilities found. Provider schemas and Terraform validation results for omitted and explicit-null optional configuration match the unchanged source baseline.

Validation: before/after offline unit tests pass; module tidy and whitespace checks pass; workflow checked with actionlint. Live service acceptance was not run. Maintainers still need to validate their release process and publish a new signed version; existing registry artifacts are unchanged.

Configured golangci-lint checks pass with v2.15.0.

Rollback Plan

Revert this change if needed and publish a new version through the normal release process. Reverting would restore the old build dependencies and their advisory matches.

Changes to Security Controls

Adds CI scanning of compiled provider binaries. No changes to provider permissions, authentication or resource behavior.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

_{Have you signed the CLA already but the status is still pending? Recheck it.}