chore(deps): weekly safe go updates · 4 packages

[mendral-app]

Packages bumped

Package	Old	New	Type
github.com/swaggo/gin-swagger	v1.6.0	v1.6.1	direct
google.golang.org/protobuf	v1.36.6	v1.36.11	indirect
github.com/klauspost/cpuid/v2	v2.2.10	v2.3.0	indirect
github.com/pelletier/go-toml/v2	v2.2.4	v2.3.1	indirect

Per-package detail

github.com/swaggo/gin-swagger v1.6.0 → v1.6.1

• Added PKCE (Proof Key for Code Exchange) support
• Internal dependency bumps
• Impact: Additive feature only; PKCE is opt-in via swagger config. No usage in this repo requires changes.

google.golang.org/protobuf v1.36.6 → v1.36.11

• Patch releases: optimizations, Edition 2024 support, URL chars in text-format, recursion limit checks
• Sets Go 1.23 minimum (we use Go 1.25, no issue)
• Impact: Indirect dep used by gin/gRPC serialization. All patches, no behavioral changes for our usage.

github.com/klauspost/cpuid/v2 v2.2.10 → v2.3.0

• Added PMU parsing, SGXPQC detection, AMD TSA mitigations detection
• Fixed division-by-zero bug in physicalCores on certain platforms
• Impact: Indirect dep (via bytedance/sonic). Purely additive CPU feature detection flags. The div-by-zero fix is beneficial.

github.com/pelletier/go-toml/v2 v2.2.4 → v2.3.1

• Removed internal unsafe usage (safety improvement, ~1.4% overhead)
• Added omitzero struct tag support
• Fixed nil pointer panic in marshaling, leap second handling
• Impact: Indirect dep (via gin config parsing). No public API breaks; omitzero is opt-in. Bug fixes are beneficial.

Files modified

• sandbox-api/go.mod
• sandbox-api/go.sum

Skipped this ecosystem

Package	Current	Reason
github.com/fsnotify/fsnotify	v1.9.0	Open PR #219 bumps to v1.10.1
github.com/gin-gonic/gin	v1.10.0	Open PR #219 bumps to v1.12.0
github.com/junegunn/fzf	v0.67.0	Open PR #219 bumps to v0.73.1
github.com/sirupsen/logrus	v1.9.3	Open PR #219 bumps to v1.9.4
github.com/swaggo/swag	v1.16.4	Open PR #219 bumps to v1.16.6
golang.org/x/crypto	v0.46.0	Open PR #219 bumps to v0.52.0
github.com/modelcontextprotocol/go-sdk	v1.2.0	Open PR #220 bumps to v1.6.1
github.com/creack/pty	v1.1.24	Already at latest stable
github.com/google/uuid	v1.6.0	Already at latest stable
github.com/gorilla/websocket	v1.5.3	Already at latest stable
github.com/joho/godotenv	v1.5.1	No stable release newer
github.com/vishvananda/netlink	v1.3.1	Already at latest stable
github.com/swaggo/files	v1.0.1	Already at latest stable

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session