Retraction of all non-current versions makes it nearly impossible to use this library

[umputun]

Hi,

Please, see go-pkgz/auth#183. I understand why you may want to retract versions, but it practically makes using this library nearly impossible. In my case, the bluemonday is used by another library (go-pkgz/auth), and retraction breaks builds of old versions completely. In fact, it is even worse - it breaks the whole chain of builds unless the dependency is vendored, and it also includes blumonday as a transitive dependency.

In my opinion, using older and potentially vulnerable versions of bluemonday should be a decision for the consumer to make. It's the consumer's responsibility to weigh the risks. Sometimes an immediate hot-fix is warranted, other times it's not. Either way, I think it's better to leave that decision to the user, rather than forcefully pushing it through a retraction.

So, here's a friendly ask: Could you please reconsider the retraction? It would make life a lot easier for those of us who rely on libraries that use bluemonday.

Thanks for considering it!