fix: bump go-arena to v1.3.0

[ysmolski]

That version includes following fixes:

• forward-only cursor in monotonicArena.Alloc by @jensneuse
• harden arena hot paths and buffer semantics

Cursor PR has extensive benchmarks for The Cosmo Router:

wundergraph/go-arena#3

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d7cb9509-17ef-4894-b613-5a6c1555092f

📥 Commits

Reviewing files that changed from the base of the PR and between 979c978 and 8685cdf.

⛔ Files ignored due to path filters (1)

• examples/engine/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• examples/engine/go.mod

✅ Files skipped from review due to trivial changes (1)

• examples/engine/go.mod

---

📝 Walkthrough

Walkthrough

Pin Go toolchain to 1.25.0 across modules, refresh direct and indirect dependency versions in core and example go.mod files, and update the execution Makefile's dependency upgrade target.

Changes

Go Toolchain and Dependency Alignment

Layer / File(s)	Summary
Core module dependencies v2/go.mod, execution/go.mod	Primary modules updated to go 1.25.0 with direct dependency bumps (github.com/wundergraph/graphql-go-tools/v2, github.com/wundergraph/cosmo/router, github.com/buger/jsonparser, github.com/wundergraph/go-arena) and indirect updates across golang.org/x/*, OpenTelemetry, and google.golang.org/genproto/grpc packages.
Example module dependencies examples/federation/go.mod, examples/engine/go.mod	Example modules aligned to go 1.25.0 with matching direct and indirect dependency updates.
Makefile update execution/Makefile	update-deps target changed to upgrade github.com/wundergraph/graphql-go-tools/v2@upgrade instead of github.com/wundergraph/cosmo/composition-go@upgrade; remaining steps unchanged.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• wundergraph/graphql-go-tools#1511: Also updates Go module dependency versions across core modules with overlapping bumps to google.golang.org and golang.org/x/* packages.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: bumping the go-arena dependency to v1.3.0, which is the primary focus reflected across multiple go.mod files and the Makefile update.
Description check	✅ Passed	The description is directly related to the changeset, explaining the purpose of the go-arena v1.3.0 bump with specific improvements and linking to relevant benchmarks.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yury/eng-9512-router-go-arena-improvements

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@examples/engine/go.mod`:
- Line 7: The module version for "github.com/wundergraph/graphql-go-tools/v2
v2.1.0" in the examples/engine go.mod is older than the rest of the repo; update
the dependency line "github.com/wundergraph/graphql-go-tools/v2" to use version
"v2.4.4" so it aligns with execution/go.mod and examples/federation/go.mod
(remove any accidental intentional pinning unless you have a reason to keep
v2.1.0).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2705396d-c48a-402b-a615-2e7f68fa2cef

📥 Commits

Reviewing files that changed from the base of the PR and between 55609f7 and 8483eae.

⛔ Files ignored due to path filters (6)

• examples/engine/go.sum is excluded by !**/*.sum
• examples/federation/go.sum is excluded by !**/*.sum
• execution/go.sum is excluded by !**/*.sum
• go.work is excluded by !**/*.work
• go.work.sum is excluded by !**/*.sum
• v2/go.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• examples/engine/go.mod
• examples/federation/go.mod
• execution/go.mod
• v2/go.mod