chore(deps): upgrade dependencies and fix stdlib vulnerability

[unclesp1d3r]

Summary

• Upgrade charmbracelet/bubbles v0.21.1 -> v1.0.0 (ceremonial release, no breaking changes)
• Upgrade golang.org/x/term v0.39.0 -> v0.40.0
• Upgrade golang.org/x/text v0.33.0 -> v0.34.0
• Upgrade golang.org/x/crypto v0.47.0 -> v0.48.0 (security patch)
• Upgrade golang.org/x/net v0.49.0 -> v0.50.0 (security patch)
• Upgrade golang.org/x/sys v0.40.0 -> v0.41.0
• Upgrade Go toolchain go1.24.5 -> go1.25.7 (fixes GO-2026-4337: unexpected session resumption in crypto/tls)

Test Plan

• just ci-check passes (0 lint issues, all tests green)
• govulncheck ./... reports 0 vulnerabilities
• go build ./... succeeds
• go test ./... all packages pass

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

Failed to post review comments

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated Go runtime to 1.25.7 and upgraded core dependencies for improved compatibility and security (including the UI component library to v1.0.0).
• Documentation
  • Updated compatibility notes and dependency guidance to reflect the new dependency versions.

Walkthrough

Go toolchain bumped to 1.25.7 and direct dependency github.com/charmbracelet/bubbles upgraded to v1.0.0; several golang.org/* and charmbracelet indirect dependencies updated. Small documentation and manifest files updated to reflect these version changes.

Changes

Cohort / File(s)	Summary
Module file go.mod	Toolchain/go directive updated to go1.25.7; direct deps updated (bubbles → v1.0.0, golang.org/x/text → v0.34.0); several indirect golang.org/* and charmbracelet/* transitive deps bumped.
Documentation / Compatibility docs/charmbracelet-compatibility-research.md	Updated dependency matrix and maintenance notes to reflect bubbles upgrade to v1.0.0.
Tool manifest mise.toml	Go version in manifest updated from 1.25.6 → 1.25.7.
Project spec project_spec/requirements.md	Runtime/system Go version updated from go1.24.5 → go1.25.7.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

documentation

Poem

🛠️ Go climbs a rung, the versions hum and sing,
Bubbles pop to one—new bells they bring,
Manifests whisper updates neat and small,
Docs nod along, version numbers tall,
A tidy sync—dependencies answer the call.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title follows conventional commit format (chore prefix with scope and descriptive message) and clearly summarizes the main changes: dependency upgrades and stdlib vulnerability fix.
Description check	✅ Passed	Description provides clear summary of dependency upgrades with version details and security context, comprehensive test results, and confirms compliance with pre-submission checklist items. However, does not follow the full template structure with explicit checkbox sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/dependency-upgrades

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR upgrades several Go dependencies and the Go toolchain itself, with the stated purpose of addressing a security vulnerability in crypto/tls. However, there are critical issues with version references that need to be addressed before this can be merged.

Changes:

• Upgrade charmbracelet/bubbles from v0.21.1 to v1.0.0 (noted as ceremonial release)
• Upgrade several golang.org/x/* packages (term, text, crypto, net, sys) to newer versions
• Upgrade Go toolchain from go1.24.5 to go1.25.7

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
go.mod	Updates direct and indirect dependency versions, upgrades Go toolchain to go1.25.7
go.sum	Updates checksums for all upgraded dependencies to match the new versions specified in go.mod