[Housekeeping] Remove unused retry dependency in flytekit

[hajapy]

Describe the issue

Remove the unused retry library dependency declared by flytekit: https://github.com/flyteorg/flytekit/blob/3b5d15acb5389d99b86ba342a77e1cab5ce8546d/setup.py#L68

This library is not used anywhere within flytekit that I can find searching for import retry or from retry, except in the sagemaker plugin: https://github.com/flyteorg/flytekit/blob/3b5d15acb5389d99b86ba342a77e1cab5ce8546d/plugins/flytekit-aws-sagemaker/flytekitplugins/awssagemaker/distributed_training.py#L8

The dependency could be moved to the sagemaker plugin's requirements so only users of that plugin need it installed. Though, given the unmaintained state of the retry library, I'd advise against that and suggest to look for a maintained alternative (reretry? https://github.com/leshchenko1979/reretry)

What if we do not do this?

All users of flytekit end up installing an unmaintained library (see invl/retry#36, not updated since 2016), which also ends up bringing with it unnecessary dependency on py which itself has been the source of lots of security alerting pytest-dev/py#287

Related component(s)

flytekit

Are you sure this issue hasn't been raised already?

• Yes

Have you read the Code of Conduct?

• Yes

[mattb-zip]

there is a maintained fork of retry that addresses this CVE in version 0.9.5 and removes the py dependency, which is actually unused:

https://pypi.org/project/retry2/#history