Update dependencies

[gleb-lobov]

No description provided.

[claude]

Pull Request Review: Update Dependencies

Summary

This PR updates Go dependencies and makes a minor import path correction. Overall, the changes are solid and recommended for merging with one suggestion noted below.

---

Code Quality & Best Practices

✅ Import Path Correction (internal/publish/logic_dp.go:22)

Excellent fix! The change from golang.org/x/net/context to the standard library context is the correct approach.

- "golang.org/x/net/context"
+ "context"

Why this matters:

• The golang.org/x/net/context package was deprecated after Go 1.9 (released in 2017)
• Using the standard library context package is idiomatic Go
• This follows Go best practices and reduces unnecessary dependencies
• The standard library context has been the canonical implementation for 7+ years

---

Dependency Updates Analysis

Go Version Update: 1.24.3 → 1.25.4

⚠️ Note: These version numbers don't match the standard Go release cycle. Current Go versions follow semantic versioning like 1.21, 1.22, 1.23, etc. Please verify:

• Is this using a custom Go fork?
• Are these version numbers correct for your build environment?

Major Dependency Updates

Updated Direct Dependencies:

• github.com/charmbracelet/log: v0.4.0 → v0.4.2 (patch update)
• github.com/go-playground/validator/v10: v10.22.1 → v10.28.0 (minor update - 6 versions)
• github.com/go-viper/mapstructure/v2: v2.1.0 → v2.4.0 (minor update)
• github.com/mark3labs/mcp-go: v0.29.0 → v0.43.1 (significant jump - check changelog)
• github.com/r3labs/diff/v3: v3.0.1 → v3.0.2 (patch update)
• github.com/spf13/cobra: v1.8.1 → v1.10.1 (minor update)
• github.com/spf13/pflag: v1.0.5 → v1.0.10 (patch updates)
• golang.org/x/net: v0.38.0 → v0.47.0 (minor update)
• golang.org/x/oauth2: v0.30.0 → v0.33.0 (minor update)
• golang.org/x/text: v0.23.0 → v0.31.0 (minor update)
• k8s.io/apimachinery: v0.33.1 → v0.34.2 (minor update)

golangci-lint Update:

• Version: v2.1 → v2.6 in .github/workflows/golangci-lint.yml
• This is good for keeping CI tooling current

---

Potential Issues & Concerns

1. Large Version Jump for mcp-go

The github.com/mark3labs/mcp-go package jumped from v0.29.0 to v0.43.1 (14 minor versions).

Recommendation:

• Review the changelog for breaking changes
• Verify that all usages of this library are still compatible
• Consider running integration tests if this package is heavily used

2. New Transitive Dependencies

The PR adds several new indirect dependencies:

• github.com/bahlo/generic-list-go
• github.com/buger/jsonparser
• github.com/charmbracelet/colorprofile
• github.com/charmbracelet/x/* (multiple packages)
• github.com/invopop/jsonschema
• github.com/mailru/easyjson
• github.com/wk8/go-ordered-map/v2

Analysis: These are likely pulled in by the charmbracelet and mcp-go updates. This is normal for dependency updates.

---

Security Considerations

✅ Security Updates

Updating golang.org/x/* packages is beneficial for security:

• golang.org/x/crypto: v0.36.0 → v0.45.0
• golang.org/x/net: v0.38.0 → v0.47.0
• golang.org/x/oauth2: v0.30.0 → v0.33.0

These often contain security fixes and should be kept current.

✅ No Obvious Security Concerns

• All dependencies are from reputable sources
• No suspicious packages introduced
• Standard library context usage reduces attack surface

---

Performance Considerations

✅ Positive Impact

• Using standard library context instead of golang.org/x/net/context may have minor performance improvements
• Newer dependency versions often include performance optimizations

⚠️ Monitor

• The significant mcp-go version jump may have performance implications
• Consider running benchmarks if this library is in hot paths

---

Testing Recommendations

Suggested Test Plan:

1. ✅ Run full test suite: go test ./...
2. ✅ Verify builds succeed: go build ./...
3. ✅ Run golangci-lint with new version
4. ⚠️ Integration tests for mcp-go functionality
5. ⚠️ Manual smoke tests if automated coverage is limited

---

Summary & Recommendation

✅ APPROVE - This PR is ready to merge with monitoring

Strengths:

• Correct fix for deprecated context import
• Security updates for golang.org/x packages
• Keeps dependencies current
• Follows Go best practices

Monitor After Merge:

• Watch for any issues related to the large mcp-go version jump
• Verify CI passes with new golangci-lint version

Overall Assessment: This is a well-structured dependency update PR. The context import fix is particularly good and demonstrates attention to Go best practices.

---

Review completed by Claude Code