chore(deps): Update some dependencies versions (#22228)

[andrii-korotkov-verkada]

Helps with #22228

Bumped some versions.

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Toolchain Guide
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[bunnyshell]

✅ Preview Environment deployed on Bunnyshell

Component	Endpoints
argocd	https://argocd-ja72ou.bunnyenv.com/
argocd-ttyd	https://argocd-web-cli-ja72ou.bunnyenv.com/

See: Environment Details | Pipeline Logs

Available commands (reply to this comment):

• 🔴 /bns:stop to stop the environment
• 🚀 /bns:deploy to redeploy the environment
• ❌ /bns:delete to remove the environment

[codecov]

Codecov Report

Attention: Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 55.89%. Comparing base (42219fd) to head (e4f007c).
Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/apiclient/apiclient.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22260      +/-   ##
==========================================
- Coverage   55.90%   55.89%   -0.02%     
==========================================
  Files         343      343              
  Lines       57305    57305              
==========================================
- Hits        32036    32030       -6     
- Misses      22624    22628       +4     
- Partials     2645     2647       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[andrii-korotkov-verkada]

I haven’t seen ctx logrus in those while working on versions upgrades

…

On Monday, March 10, 2025, Michael Crenshaw ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In util/grpc/logging.go <#22260 (comment)>: > @@ -83,7 +82,7 @@ func reportable(entry *logrus.Entry, callType string, logClaims bool) intercepto return func(ctx context.Context, c interceptors.CallMeta) (interceptors.Reporter, context.Context) { return &reporter{ ctx: ctx, - entry: entry.WithFields(ctx_logrus.Extract(ctx).Data), + entry: entry, Is it possible that ctx_logrus is called by external code? Maybe pkg or gitops-engine? — Reply to this email directly, view it on GitHub <#22260 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BAXACXQHN6AJJFHWNMVPZ732TWZMNAVCNFSM6AAAAABYTFKCAOVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDMNZRGMYDCOJSHE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[crenshaw-dev]

I really don't think we should do this. imo using a fork of a lightly-maintained library is worse than just using the lightly-maintained library.

[andrii-korotkov-verkada]

But their dependencies are quite old. Should I just use replace on dependencies of the libs?

…

On Monday, March 10, 2025, Michael Crenshaw ***@***.***> wrote: ***@***.**** requested changes on this pull request. ------------------------------ In go.mod <#22260 (comment)>: > + github.com/google/go-jsonnet => github.com/andrii-korotkov-verkada/go-jsonnet v0.0.0-20250308155707-03f98b787f0e github.com/grpc-ecosystem/grpc-gateway => github.com/grpc-ecosystem/grpc-gateway v1.16.0 + github.com/improbable-eng/grpc-web => github.com/andrii-korotkov-verkada/grpc-web v0.0.0-20250308221419-d37df84c6882 + github.com/olekukonko/tablewriter => github.com/andrii-korotkov-verkada/tablewriter v0.0.0-20250308155854-8571ed54aa92 + github.com/r3labs/diff/v3 => github.com/andrii-korotkov-verkada/diff/v3 v3.0.0-20250308155935-ef18f9606732 + github.com/soheilhy/cmux => github.com/andrii-korotkov-verkada/cmux v0.0.0-20250308160011-2ab3fff3705c I really don't think we should do this. imo using a fork of a lightly-maintained library is worse than just using the lightly-maintained library. — Reply to this email directly, view it on GitHub <#22260 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BAXACXVWZIKAETQXLKMGKOL2TXLKLAVCNFSM6AAAAABYTFKCAOVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDMNZRG42DGNRTGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[crenshaw-dev]

That's one option. But in each case we should have a good reason why we're adding the replace. The only justification I can think of is the presence of a high- or critical-severity vulnerability or a lower-severity vulnerability that's been shown to directly impact our users.

[andrii-korotkov-verkada]

@crenshaw-dev, I've reverted the fork changes