chore(deps): bump go deps

[hanabi1224]

Summary of changes

bump go deps and resolve the breaking change in go-libp2p: https://filecoinproject.slack.com/archives/CP50PPW2X/p1762446290629389

Changes introduced in this pull request:

Reference issue to close (if applicable)

Closes

Other information and links

Change checklist

• I have performed a self-review of my own code,
• I have made corresponding changes to the documentation. All new code adheres to the team's documentation standards,
• I have added tests that prove my fix is effective or that my feature works (if possible),
• I have made sure the CHANGELOG is up-to-date. All user-facing changes should be reflected in this document.

Summary by CodeRabbit

• Chores
  • Updated Go module dependencies across sidecar and interop-test modules, including libp2p (v0.45.0), IPFS components, Prometheus libraries, WebRTC stack, and cryptographic utilities to latest versions.
  • Enhanced logging infrastructure integration.

[coderabbitai]

Walkthrough

This pull request updates Go module dependencies in f3-sidecar and interop-tests, bumping versions for libp2p, ipfs/boxo, pion components, Prometheus, and Go standard library packages. Additionally, logging integration is added to f3-sidecar/utils.go to route slog through the existing go-log system.

Changes

Cohort / File(s)	Summary
Go module dependency updates f3-sidecar/go.mod, interop-tests/src/tests/go_app/go.mod	Multiple version bumps across ecosystem packages: libp2p v0.45.0, ipfs/boxo v0.35.2, ipfs/go-log/v2 v2.9.0, pion components (webrtc v4.1.6, rtp v1.8.25, etc.), Prometheus common v0.67.2, and golang.org/x/\* packages (crypto v0.43.0, net v0.46.0, sys v0.37.0, etc.).
Logging integration f3-sidecar/utils.go	Routes Go's slog logs through go-log system and initializes libp2p shim for logging in setLogLevels function. No behavioral changes to existing log level settings.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Dependency version updates are mechanical and repetitive across two files; verify version compatibility and semver alignment
• Logging changes in utils.go are initialization-only; confirm slog/gologshim integration doesn't introduce side effects

Possibly related PRs

• chore(deps): bump go deps #6135: Updates overlapping Go module dependencies in f3-sidecar/go.mod and interop-tests go.mod, plus modifies logging/init code
• chore(deps): bump go-f3 and Go deps #5881: Performs identical dependency version bumps across f3-sidecar/go.mod and interop-tests/src/tests/go_app/go.mod
• chore(deps): bump go-f3 #6019: Bumps overlapping dependencies (ipfs/boxo, ipfs/go-log/v2, pion components, gnark-crypto) in the same module files

Suggested labels

dependencies, go

Suggested reviewers

• LesnyRumcajs
• akaladarshi
• sudo-shashank

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'chore(deps): bump go deps' accurately describes the main change—updating Go dependencies across multiple modules—and aligns with the changeset that shows version bumps for go-jsonrpc, libp2p, Pion stack, Prometheus, and golang.org/x packages.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch hm/bump-go-deps

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f2c9f94 and 527b2c9.

⛔ Files ignored due to path filters (2)

• f3-sidecar/go.sum is excluded by !**/*.sum
• interop-tests/src/tests/go_app/go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• f3-sidecar/go.mod (6 hunks)
• f3-sidecar/utils.go (3 hunks)
• interop-tests/src/tests/go_app/go.mod (7 hunks)

🧰 Additional context used

🧠 Learnings (3)

📓 Common learnings

Learnt from: hanabi1224
Repo: ChainSafe/forest PR: 5930
File: build.rs:64-77
Timestamp: 2025-08-13T09:43:20.301Z
Learning: hanabi1224 prefers hard compile-time errors in build scripts rather than runtime safeguards or collision detection, believing it's better to fail fast and fix root causes of issues like malformed snapshot names.

Learnt from: hanabi1224
Repo: ChainSafe/forest PR: 6057
File: src/cli/subcommands/f3_cmd.rs:0-0
Timestamp: 2025-09-09T10:37:17.947Z
Learning: hanabi1224 prefers having default timeouts (like 10m for --no-progress-timeout) to prevent commands from hanging indefinitely, even when the timeout flag isn't explicitly provided by users. This fail-fast approach is preferred over requiring explicit flag usage.

📚 Learning: 2025-08-07T13:12:23.359Z

Learnt from: hanabi1224
Repo: ChainSafe/forest PR: 5886
File: Makefile:1-1
Timestamp: 2025-08-07T13:12:23.359Z
Learning: golangci-lint version v2.3.1 exists and was released on August 2, 2025. It is currently the latest stable version and can be used in Makefiles and CI configurations. The version follows the v2.x.x numbering scheme, not v1.x.x as I previously incorrectly stated.

Applied to files:

• interop-tests/src/tests/go_app/go.mod

📚 Learning: 2025-08-07T13:12:23.359Z

Learnt from: hanabi1224
Repo: ChainSafe/forest PR: 5886
File: Makefile:1-1
Timestamp: 2025-08-07T13:12:23.359Z
Learning: golangci-lint version v2.3.1 exists and is a valid release that can be used in Makefiles and CI configurations. It was released after v2.3.0.

Applied to files:

• interop-tests/src/tests/go_app/go.mod

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

• GitHub Check: Build forest binaries on Linux AMD64
• GitHub Check: tests-release
• GitHub Check: tests
• GitHub Check: cargo-publish-dry-run
• GitHub Check: Build Ubuntu
• GitHub Check: Build MacOS
• GitHub Check: All lint checks

🔇 Additional comments (4)

f3-sidecar/utils.go (2)

6-6: LGTM: Imports added for logging integration.

The new imports for log/slog and gologshim are appropriate for routing logs through the go-log system.

Also applies to: 15-15

---

61-65: Logging integration correctly addresses go-libp2p breaking change.

Both required APIs have been verified:

• logging.SlogHandler() exists in go-log/v2 v2.9.0
• gologshim.SetDefaultHandler() exists in go-libp2p v0.45.0

The implementation matches the documented example and calls are in the correct order.

f3-sidecar/go.mod (1)

7-14: All dependency updates are secure; no unpatched vulnerabilities detected.

The security verification confirms that the updated versions are safe:

• go-libp2p v0.45.0: All detected vulnerabilities are in older versions (≤0.27.3 and earlier).
• golang.org/x/crypto v0.43.0: All detected vulnerabilities are patched (CRITICAL authorization bypass fixed in 0.31.0, HIGH DoS fixed in 0.35.0, all others similarly addressed).

No action required.

interop-tests/src/tests/go_app/go.mod (1)

6-11: No security issues identified; dependency updates are safe to proceed.

go-libp2p v0.45.0 has no public CVEs. Earlier high-impact vulnerabilities were fixed in older go-libp2p releases (0.27.8, 0.28.2, 0.29.1), and v0.45.0 is above all patched versions. The CVE affecting libp2p v0.45.0 applies to the Rust implementation, not go-libp2p. Other major dependencies (rust2go, boxo, go-cid, go-log) showed no disclosed vulnerabilities. The dependency updates are compatible and secure.

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.5.0)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain modules listed in go.work or their selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}