chore: update deps

[indrasaputra]

Summary

update deps

Description

update deps.
Go is not updated to 1.25.3 eventhough it exists. this is the problem

CI tests were failing with ThreadSanitizer memory allocation errors after updating dependencies:
==11058==ERROR: ThreadSanitizer failed to allocate 0x2000000 (33554432) bytes at address cab63d160000 (errno: 12)
FAIL	github.com/indrasaputra/arjuna/service/wallet/entity	0.007s

The update upgraded Go from 1.25.2 to 1.25.3. Go 1.25.3 introduced a regression or behavioral change in the race detector (ThreadSanitizer) that significantly increases memory consumption during tests with the -race flag. This caused tests to exceed GitHub Actions' memory limits and fail with OOM (Out Of Memory) errors.
Tests on the main branch (using Go 1.25.2) passed without issues, confirming this was specific to the Go version upgrade.

Summary by Sourcery

Chores:

• Update development environment dependencies in devbox configuration and lockfile

Summary by CodeRabbit

• Chores
  • Updated development tooling dependencies to maintain compatibility and support latest improvements.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates Devbox dependencies by bumping versions in devbox.json and regenerating the lock file to reflect those changes.

File-Level Changes

Change	Details	Files
Update dependencies configuration	Bump dependency versions to latest Adjust version constraints where required	devbox.json
Regenerate lock file	Re-run lock process to update checksums Lock updated dependency versions	devbox.lock

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Updated package versions in the development environment configuration file: golangci-lint from 2.6.0 to 2.6.2 and atlas from 0.37.0 to 0.38.0. No behavioral changes or new functionality introduced.

Changes

Cohort / File(s)	Summary
Dependency version updates devbox.json	Bumped golangci-lint to 2.6.2 (from 2.6.0) and atlas to 0.38.0 (from 0.37.0)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• chore: update deps #80: Previous golangci-lint version bump to 2.6.0, now further updated to 2.6.2 in this PR

Poem

🐰 A version bump here, a version bump there,
Dependencies dancing without a care,
golangci-lint and atlas take their flight,
Keeping the devbox fresh and tight! ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	PR description lacks clarity and structure. It mentions Go 1.25.3 causing ThreadSanitizer failures but dev packages show no Go version changes, creating confusion about the actual problem being addressed.	Clarify which specific dependency updates are being made and why. If ThreadSanitizer issues prevent the Go upgrade, explicitly state this decision and explain why only golangci-lint and atlas were updated instead.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'chore: update deps' is directly related to the changeset and accurately summarizes the main change of updating package versions in devbox.json.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch update-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Hey there - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢	No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
Update

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

No code suggestions found for the PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.63%. Comparing base (16271ab) to head (5e1c0d0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #81   +/-   ##
=======================================
  Coverage   58.63%   58.63%           
=======================================
  Files          58       58           
  Lines        1987     1987           
=======================================
  Hits         1165     1165           
  Misses        788      788           
  Partials       34       34           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 16271ab and d23c097.

⛔ Files ignored due to path filters (2)

• devbox.lock is excluded by !**/*.lock
• go.work is excluded by !**/*.work

📒 Files selected for processing (8)

• devbox.json (2 hunks)
• gateway/go.mod (1 hunks)
• pkg/sdk/go.mod (1 hunks)
• proto/go.mod (1 hunks)
• service/auth/go.mod (1 hunks)
• service/transaction/go.mod (1 hunks)
• service/user/go.mod (1 hunks)
• service/wallet/go.mod (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (40)

• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review
• GitHub Check: Compile binary / Compile go binary
• GitHub Check: Go code quality check / Unit test and coverage
• GitHub Check: Go code quality check / go-code-lint
• GitHub Check: Sourcery review

🔇 Additional comments (1)

service/user/go.mod (1)

3-3: Consistent Go version bump to 1.25.3 across all modules.

All go.mod files are updated uniformly. Patch version upgrade follows best practices for systematic dependency management.