go.mod,ui/package-lock.json: dependency and security updates

[mostlygeek]

Summary by CodeRabbit

• Chores
  • Updated Go version to 1.25.4.
  • Updated core dependencies including security and networking libraries to latest versions.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Go version updated from 1.23.0 to 1.25.4. Multiple indirect dependencies upgraded: golang.org/x/crypto, golang.org/x/net, golang.org/x/sys, and golang.org/x/text. No functional or logic changes.

Changes

Cohort / File(s)	Summary
Go module version updates go.mod	Go version bumped from 1.23.0 to 1.25.4; indirect dependencies updated: golang.org/x/crypto v0.36.0 → v0.45.0, golang.org/x/net v0.38.0 → v0.47.0, golang.org/x/sys v0.31.0 → v0.38.0, golang.org/x/text v0.23.0 → v0.31.0

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

• Routine dependency version bumps with no functional changes
• Verify that all updated versions are compatible with the codebase
• Consider testing with the new Go version to ensure no compatibility issues

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main changes: dependency version updates in go.mod and security updates. It aligns with the file modifications and upgrade objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch dep-updates

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c968da1 and bf2267f.

⛔ Files ignored due to path filters (2)

• go.sum is excluded by !**/*.sum
• ui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• go.mod (2 hunks)

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2025-10-07T05:41:52.728Z

Learnt from: mostlygeek
Repo: mostlygeek/llama-swap PR: 337
File: proxy/config/config.go:268-291
Timestamp: 2025-10-07T05:41:52.728Z
Learning: In the mostlygeek/llama-swap repository's proxy/config/config.go, macro-in-macro substitution requires that referenced macros be declared earlier in the YAML file (declaration order matters). A macro can only reference macros that appear before it in the configuration. The YAML order is preserved by the UnmarshalYAML implementation for MacroList, and the LIFO substitution approach is intentional.

Applied to files:

• go.mod

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: run-tests
• GitHub Check: run-tests

🔇 Additional comments (2)

go.mod (2)

3-3: No action needed. The Go version bump from 1.23.0 to 1.25.4 is safe and follows the Go 1 compatibility promise, which guarantees source-level backward compatibility across minor versions. The codebase has no version-specific build guards, deprecated API usage related to this change, or platform-specific concerns that would prevent this upgrade.

---

40-43: No actionable items: golang.org/x dependencies are secure and current.

The four golang.org/x packages are properly updated and secure as of November 2025:

• golang.org/x/crypto v0.45.0 — Fixes CVE-2025-58181 (SSH GSSAPI unbounded memory) and CVE-2025-47914 (SSH agent malformed-message panic). ✓
• golang.org/x/net v0.47.0 — Includes fixes for CVE-2025-47911, CVE-2025-58190, CVE-2025-22872, and CVE-2025-22870 from the version range. ✓
• golang.org/x/sys v0.38.0 — No active 2025 CVEs. ✓
• golang.org/x/text v0.31.0 — No active 2025 CVEs. ✓

go.sum is properly maintained with valid hashes for all packages. No breaking changes identified. These are indirect dependencies pulled in by direct dependencies (Gin, etc.), and their versions are appropriately up-to-date.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}