chore(deps): update dependency go to v1.25.4

[renovate[bot]]

This PR contains the following updates:

Package	Type	Update	Change
go		patch	1.25.1 -> 1.25.4
go (source)	toolchain	patch	1.25.1 -> 1.25.4

---

Release Notes

golang/go (go)

v1.25.4

Compare Source

v1.25.3

Compare Source

v1.25.2

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions[bot]]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

• Security Fixes: Go 1.25.2 addresses 8 critical CVEs including memory exhaustion, CPU consumption issues, and validation vulnerabilities across crypto/x509, net/http, encoding/asn1, archive/tar, net/textproto, net/url, and encoding/pem packages
• Bug Fixes: Go 1.25.3 includes additional crypto/x509 fixes, Go 1.25.4 includes compiler, runtime, and package fixes for crypto/subtle, encoding/pem, net/url, and os
• Breaking Changes: None identified - these are patch releases within the Go 1.25 series maintaining backward compatibility
• Upgrade Type: Patch releases (1.25.1 → 1.25.4) focusing on security and stability improvements

🎯 Impact Scope Investigation

• Go Module Changes: Updates toolchain version in go.mod:5 and mise configuration in mise.toml:2
• Build Dependencies: Project uses mise for toolchain management via GitHub Actions .github/actions/setup/action.yml:7
• Minimum Go Version: Project specifies go 1.24.0 as minimum version in go.mod:3, well below the toolchain version
• No Direct Version Constraints: No hardcoded Go version dependencies found in source code or CI workflows
• Dependency Impact: All existing dependencies remain compatible as this is a patch-level toolchain update

💡 Recommended Actions

• Immediate Merge Recommended: This is a security-critical patch release with multiple CVE fixes
• No Code Changes Required: Toolchain update only affects build environment, not application code
• Testing: Standard CI pipeline should validate compatibility automatically
• Priority: High due to security fixes, especially CVEs affecting HTTP, TLS, and parsing libraries used by web applications

🔗 Reference Links

• Go 1.25.2 Security Issues
• Go Release History

Generated by koki-develop/claude-renovate-review