go.mod: Replace carolynvs/magex with uwu-tools/magex v0.10.0

[justaugustus]

What does this change

• go.mod: Replace carolynvs/magex with uwu-tools/magex v0.10.0

What issue does it fix

Original repo will no longer receive updates.
While the package does not require frequent updates, I'd like to ensure that dependents have an import that will receive periodic & security updates.

Notes for the reviewer

This change was discussed with @schristoff, who is now also a co-maintainer of the project.

uwu-tools/magex has existing CNCF dependents, including Kubernetes Release Engineering and Project Stacker: https://github.com/uwu-tools/magex/network/dependents

• Fork notice: Fork notice carolynvs/magex#30
• Attribution: https://github.com/uwu-tools/magex#attribution
• Initial commit: Add attribution and "In Memoriam" section for Carolyn Van Slyck uwu-tools/magex#1
• v0.10.0 tag (which mirrors carolynvs/magex@v0.9.0): https://github.com/uwu-tools/magex/releases/tag/v0.10.0

Checklist

• (N/A) Did you write tests?
• (N/A) Did you write documentation?
• (N/A) Did you change porter.yaml or a storage document record? Update the corresponding schema file.
• If this is your first pull request, please add your name to the bottom of our Contributors list. Thank you for making Porter better! 🙇‍♀️

[justaugustus]

I noticed get.porter.sh/magefiles would also need this change, so I've opened a PR here: getporter/magefiles#45

[troy0820]

Thanks @justaugustus for doing this. Looking over the PR now.

[troy0820]

This looks good to me. Not sure how you want to do this @schristoff but we can merge this and then the other or the other promote to v0.10.0 and then import that to get rid of the indirect dep.

[justaugustus]

...but we can merge this and then the other or the other promote to v0.10.0 and then import that to get rid of the indirect dep

@troy0820 — Minor aside that getporter/magefiles does not have Dependabot configured (unlike this repo; unsure if that's intentional), so any future updates on the upstream will require manual intervention (which could cause the magex versions to diverge).

[troy0820]

@troy0820 — Minor aside that getporter/magefiles does not have Dependabot configured (unlike this repo; unsure if that's intentional), so any future updates on the upstream will require manual intervention (which could cause the magex versions to diverge).

Yeah, not sure if we want to but it will be good to enforce that there so we can deal with CVEs updates where necessary and uplift that here. We can put an issue there for this. I can merge this PR.

Thanks @justaugustus

[justaugustus]

Happy to help, Troy!