govulncheck reported 30 reachable vulnerabilities. Remediation:
- Pin `toolchain go1.25.12` and build CI on Go 1.25 (lint/tests workflows):
clears ~24 Go standard-library CVEs (crypto/tls, crypto/x509, net/http,
html/template, net/url, os, …) that were present under go1.24.7.
- Bump `golang.org/x/net` v0.38.0 -> v0.55.0 and `google.golang.org/grpc`
v1.71.1 -> v1.79.3 (grpc raises the module's Go directive to 1.25).
Result: govulncheck drops from 30 -> 2. The remaining two
(github.com/jackc/pgx/v4, github.com/jackc/pgproto3/v2) have no upstream fix
and require a pgx v5 migration — tracked separately; the govulncheck gate will
follow with those explicitly allow-listed until migrated.
Note: this raises go-micro's minimum Go to 1.25 (forced by the grpc security
bump). Verified: build, go vet, and the ai/agent/flow/store/registry/broker/
wrapper/cmd + grpc/net-dependent packages pass on 1.25.12.
Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL
Co-authored-by: Claude <noreply@anthropic.com>
* Initial plan
* Replace KeepAliveOnce with KeepAlive to reduce etcd auth requests
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* Add tests to verify cache penetration protection via singleflight
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* Add etcd integration tests to CI workflow
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* Fix race conditions and improve code quality based on review feedback
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* Add workflow permissions to fix security scan finding
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* Add comprehensive documentation for performance improvements
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* Fix memory store limit/offset bug causing events test failure
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* Fix memory store to filter before limiting in prefix/suffix reads
The previous fix had a logic error where limit/offset were applied before
prefix/suffix filtering. This could cause incorrect results when the first
N items in the unfiltered list don't match the search criteria.
Now filters first to get all matching keys, then applies limit/offset to
the filtered results. This ensures ReadLimit(1) always returns 1 matching
record if available, regardless of map iteration order.
Co-authored-by: asim <17530+asim@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: asim <17530+asim@users.noreply.github.com>
* feat: more plugins
* chore(ci): split out benchmarks
Attempt to resolve too many open files in ci
* chore(ci): split out benchmarks
* fix(ci): Attempt to resolve too many open files in ci
* fix: set DefaultX for cli flag and service option
* fix: restore http broker
* fix: default http broker
* feat: full nats profile
* chore: still ugly, not ready
* fix: better initialization for profiles
* fix(tests): comment out flaky listen tests
* fix: disable benchmarks on gha
* chore: cleanup, comments
* chore: add nats config source
Asim Aslam