[whykusanagi]

Security audit

govulncheck -show verbose ./... found zero reachable symbol findings but three vulnerable imported packages: google.golang.org/grpc GO-2026-6443 at 1.83.1; github.com/ipld/go-ipld-prime GO-2026-5684 and GO-2026-5073 at 0.20.0. Upgrade to fixed grpc 1.83.2 and ipld-prime 0.23.0, including compatible indirect dependencies selected by go mod tidy.

Validation

go test ./... -count=1, Go-1.26.9 lint, go build ./..., go mod verify, pure-Go builtin/llm tests, Windows/Linux CGO=0 cross-builds passed locally. Re-run govulncheck ./... reports zero vulnerable imported packages and one module-only finding GO-2026-5932 for golang.org/x/crypto/openpgp with no upstream fixed version and no matching symbol use. Run CI, CodeRabbit/Aikido and macOS/Windows tests before merge.

Independent of stabilization PR #446; this PR changes dependencies only.

Summary by CodeRabbit

• Chores
  • Updated underlying components to newer versions. No changes to user-visible features or behavior were reported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 91798ae3-ded2-4b72-b34b-d29b8d084540

📥 Commits

Reviewing files that changed from the base of the PR and between df2896d and 2287b66.

⛔ Files ignored due to path filters: 1

• go.sum is excluded by !**/*.sum

📒 Files selected for processing: 1

• go.mod

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

The go.mod file updates the versions of four indirect dependencies: go-ipld-prime, go-multicodec, polydawn/refmt, and google.golang.org/grpc.

Changes: Indirect dependency updates

Layer / File(s)	Summary
Update indirect dependency versions go.mod	The required versions of go-ipld-prime, go-multicodec, polydawn/refmt, and google.golang.org/grpc are updated.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 2287b

The updated dependency versions resolve as intended, and this review found no actionable merge risk.

### Architecture Summary

Architecture risk: 🔵 Low · up to 2287b

The change affects 1 system.

Changed systems: go.mod

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — go.mod (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in go.mod: The indirect go-ipld-prime requirement was upgraded from v0.20.0 to v0.23.0.
• observed — Modified behavior in go.mod: The indirect go-multicodec requirement was upgraded from v0.9.0 to v0.10.0, and polydawn/refmt from v0.89.0 to v0.89.1-0.20231129105047-37766d95467a; the intervening requirements are unchanged.
• observed — Modified behavior in go.mod: The indirect google.golang.org/grpc requirement was upgraded from v1.83.1 to v1.83.2.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: updating vulnerable gRPC and IPLD dependencies.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}