fix(main): Upgrade to go 1.25.5 and moby/build-kit across modules

[elizabethhealy]

Proposed Changes

• Go Version Upgrade: Upgraded the Go version from 1.25.0 to 1.25.5 across the workspace and BDD test module.
• Dependency Updates: Updated several Go dependencies in the BDD test module to address potential vulnerabilities and ensure compatibility.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

Summary by CodeRabbit

• Chores
  • Updated Go language version requirements across all project modules to improve compatibility and consistency.
  • Refreshed core dependencies to incorporate upstream security patches and performance improvements in build utilities, cryptographic libraries, and container management tools.

[coderabbitai]

📝 Walkthrough

Walkthrough

Go module language versions are updated from go 1.25.0 to go 1.25.5 across nine go.mod files. Additionally, tests-bdd/go.mod receives dependency version updates for several indirect packages including in-toto-golang, attestation, compress, buildkit, patternmatcher, go-securesystemslib, and sigstore-go.

Changes

Cohort / File(s)	Summary
Go version updates (lib modules) lib/fixtures/go.mod, lib/flattening/go.mod, lib/identifier/go.mod, lib/ocrypto/go.mod	Updated Go language version directive from 1.25.0 to 1.25.5.
Go version updates (other modules) examples/go.mod, protocol/go/go.mod, sdk/go.mod, service/go.mod	Updated Go language version directive from 1.25.0 to 1.25.5.
Go version and dependency updates tests-bdd/go.mod	Updated Go language version to 1.25.5 and bumped indirect dependencies: in-toto-golang to v0.10.0, added attestation v1.1.2, compress to v1.18.4, buildkit to v0.28.1, patternmatcher to v0.6.1, go-securesystemslib to v0.10.0, and sigstore-go to v1.1.4 (from pseudo-version).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• opentdf/platform#3225: Modifies tests-bdd/go.mod with similar Go version and dependency upgrade changes.

Suggested labels

size/m

Suggested reviewers

• jentfoo
• c-r33d

Poem

🐰 A hop across the modules, versions climb,
From 1.25.0 to 1.25.5 in time,
Dependencies dance their upgrade ballet,
Nine go.mod files all brightened today! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main changes in the PR: Go version upgrades from 1.25.0 to 1.25.5 across multiple modules, and dependency updates including moby/buildkit.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-vulncheck-tests-bdd

Warning

Review ran into problems

🔥 Problems

Timed out fetching pipeline failures after 30000ms

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on maintaining the security and stability of the BDD test suite by upgrading the Go toolchain version and updating various project dependencies to their latest secure versions.

Highlights

• Go Version Upgrade: Upgraded the Go version from 1.25.0 to 1.25.5 across the workspace and BDD test module.
• Dependency Updates: Updated several Go dependencies in the BDD test module to address potential vulnerabilities and ensure compatibility.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

---

The version bumped to keep us tight, / To keep the vulnerabilities out of sight. / With dependencies fresh and code in line, / The tests will surely run just fine.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[github-actions]

X-Test Failure Report

opentdfplatform60UAZ2.dockerbuild

[gemini-code-assist]

Code Review

This pull request updates the Go version to 1.25.5 and bumps several dependencies in the tests-bdd module. The review highlights that the Go version update should be applied consistently across all modules defined in go.work to ensure environment parity. Additionally, it is recommended to run 'go mod tidy' to ensure that the go.sum file is correctly synchronized and fully populated with the necessary hashes for the updated dependencies.

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	210.096067ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.607577ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	404.366408ms
Throughput	247.30 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.662022489s
Average Latency	415.63246ms
Throughput	120.01 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	207.747834ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.909288ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	388.802761ms
Throughput	257.20 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.787569172s
Average Latency	406.590811ms
Throughput	122.59 requests/second

[github-actions]

X-Test Failure Report

✅ java-v0.9.0
✅ js-pull-3227
✅ js-v0.9.0
test-cases-mapping-report
bats-test-results
cukes-report
opentdfplatformM6E20M.dockerbuild

[github-actions]

X-Test Failure Report

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	197.789221ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.014541ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	388.000604ms
Throughput	257.73 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.921029728s
Average Latency	407.006117ms
Throughput	122.19 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	195.905682ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.88938ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	384.226532ms
Throughput	260.26 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	41.825018535s
Average Latency	415.772372ms
Throughput	119.55 requests/second

[github-actions]

X-Test Results

✅ go-pull-3227
✅ java-pull-3227
✅ go-v0.9.0
✅ js-pull-3227
✅ java-v0.9.0
test-cases-mapping-report
✅ js-v0.9.0
bats-test-results
cukes-report
opentdfplatformSDJGFI.dockerbuild

[elizabethhealy]

resolved by another PR