False positive with carlmjohnson/requests package

[Crocmagnon]

Hello! 👋🏻

The following piece of code triggers bodyclose:

package main

import (
	"bytes"
	"context"
	"net/http"

	"github.com/carlmjohnson/requests"
)

func main() {
	var errResp bytes.Buffer

	_ = requests.URL("https://example.com/").
		Method(http.MethodPost).
		AddValidator(requests.ValidatorHandler(requests.DefaultValidator, requests.ToBytesBuffer(&errResp))).
		Fetch(context.Background())
}

$ golangci-lint run --enable bodyclose ./...
main.go:16:91: response body must be closed (bodyclose)
                AddValidator(requests.ValidatorHandler(requests.DefaultValidator, requests.ToBytesBuffer(&errResp))).

Interestingly, when removing the net/http import (for example by removing the Method or replacing it with an equivalent string), the issue disappears.

I first reported this to carlmjohnson/requests in this discussion and the package author seemed confident that the response body was indeed closed:

This is almost certainly a false positive. All request-responses go through the do function, which ensures Body.Close is called: https://github.com/earthboundkid/requests/blob/ed53f999490f0b01ce87a75cfeef18a53b970eef/core_do.go#L16-L36
I think the bug should be filed with the linter. I don't know what they are looking for, but it seems to be keying off the wrong thing in the requests package.