Update server dependencies

[rongxin-liu]

Reviewable diff: +127/-130 across 10 files (excludes generated, test, and story files).

Summary

Refreshes the server and plugin dependency baseline to current compatible releases, including etcd 3.7.1 and gRPC 1.83.0. It also updates ASIC-rs to quinn-proto 0.11.15, removing the vulnerable version reported by high-severity Dependabot alert 59. etcd 3.7.1 raises the minimum language target to Go 1.26; the workspace and build toolchain already use the current Go 1.26.5 release.

How it works

The canonical just update-go-deps workflow refreshes the main server, three Go plugins, and fake Proto rig; the contract-test and fake Antminer modules are checked separately because they are outside that recipe. go mod tidy reconciles each module and go work sync verifies the workspace graph. A post-rebase refresh advanced the newly released plan9stats pseudo-version and aligned plugin references with the updated main server commit.

The open Go Dependabot PR #866 is fully covered by this branch. The security-alert audit also found the transitive ASIC-rs vulnerability, which is not fixed by the open Rust update PR #867; this PR patches that runtime dependency directly. The remaining open React Router alert is client-only and stays outside this server-focused change.

flowchart LR
  A["Canonical Go dependency refresh"] --> B["Seven Go modules"]
  C["Dependabot PR audit"] --> D["Confirm Go updates are covered"]
  E["Security alert audit"] --> F["Patch ASIC-rs quinn-proto"]
  B --> G["Build, lint, and dependency checks"]
  D --> G
  F --> G

Loading

Areas of the code involved

Area / package / file	What changed	Why it matters for review
server/go.mod, server/go.sum	Refreshed direct and transitive dependencies, including etcd, gRPC, CEL, gopsutil, JSON-RPC, and the latest plan9stats pseudo-version	Main server compile and runtime dependency surface; etcd establishes the Go 1.26 minimum
plugin/proto	Refreshed gRPC, Moby client/archive, Docker connections, system metrics, and the internal server pseudo-version	Exercises the largest independent Go plugin dependency graph
plugin/antminer, plugin/virtual	Refreshed shared gRPC/system dependencies and the internal server pseudo-version	Keeps independently built plugins aligned with the rebased server
plugin/asicrs/Cargo.lock	Advanced quinn-proto from 0.11.14 to patched 0.11.15	Removes the high-severity remote memory-exhaustion vulnerability from the ASIC-rs runtime
tests/plugin-contract	Refreshed gRPC and shared transitive dependencies	Keeps contract validation on the same RPC baseline
go.work.sum	Synchronized workspace checksums after generation	Keeps clean-checkout generation deterministic

Key technical decisions & trade-offs

• Use compatible updates only: the established go get -u -t ./... workflow avoids unrelated module-path major migrations.
• Advance application modules to Go 1.26: etcd 3.7.1 requires Go 1.26; retaining the previous 1.25.4 target would require holding etcd back.
• Patch the server-side Rust alert here: quinn-proto is a runtime dependency of ASIC-rs and the open Rust Dependabot PR does not update it; unrelated Rust and client dependency updates remain in their own PRs.
• Keep the contract-test patch directive: just test-contract reads tests/plugin-contract/go.mod verbatim to select the golang:1.26.5-alpine image, so it intentionally tracks the workspace toolchain patch.
• Keep toolchain pins unchanged: Go 1.26.5 is still the latest stable release and is already used by the workspace and build images.

Testing & validation

• All seven Go modules compile successfully, including their test packages.
• All seven module graphs pass go mod verify, with no remaining direct dependency updates reported by go list -m -u.
• The full server test suite passed against an isolated TimescaleDB instance before the rebase; the final dependency-only refresh was compile-tested across every module.
• Server, Proto plugin, and Antminer plugin lint passed on the final tree.
• The ASIC-rs Docker plugin rebuilt successfully with quinn-proto 0.11.15.
• Proto, Antminer, and virtual plugin short tests passed.
• Fake Proto rig, fake Antminer, and contract short tests passed.
• govulncheck ./... reports zero reachable vulnerabilities in all seven Go modules. The server graph retains one module-only advisory for the unimported, unmaintained golang.org/x/crypto/openpgp package; it has no fixed version.
• go work sync and git diff --check passed.
• just gen passed before the rebase. A final local rerun was blocked while reinstalling the newly rebased client lockfile because Block's dependency-confusion filter denied npm registry access; CI's generated-code check validates the final tree.

Post-Deploy Monitoring & Validation

• Logs: watch fleet API and plugin logs for panic, fatal, etcd, grpc, plugin exited, and repeated connection failures.
• Metrics: monitor existing fleet API request-error, HA ownership, and plugin-health signals.
• Healthy signal: normal server startup, stable etcd/HA operation, and unchanged plugin connectivity.
• Failure/mitigation trigger: sustained startup, ownership, RPC, or plugin failures attributable to the new dependency graph trigger rollback to the previous release image.
• Window/owner: release operator or on-call monitors the first 30 minutes after deployment.

---

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (ee835ddcc1bce68a227bd7945608263e0b457652...bcd1d1b484a420b28ab5f35422317a4fef44ed7b, exact PR three-dot diff)
• Model: gpt-5.5

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: NONE

Findings

No security, correctness, or reliability findings were identified in the changed hunks.

Notes

The PR scope is limited to dependency and lockfile metadata updates across Go modules, the Go workspace checksum file, and the Rust ASIC plugin Cargo lockfile. I did not identify changed application logic, auth paths, database queries, miner command handling, pool configuration, network discovery behavior, or protobuf schema changes in .git/codex-review.diff.

I did not run tests; this review is based on the authoritative diff only.

---

_{Generated by Codex Security Review |
Triggered by: @rongxin-liu |
Review workflow run}

[Copilot]

Pull request overview

Updates the Go dependency baseline across the server module, several plugin modules, and the plugin-contract test module—primarily bumping etcd to v3.7.1 (driving a Go 1.26 minimum) and gRPC to v1.83.0.

Changes:

• Bumped server module to go 1.26 and refreshed key deps (etcd v3.7.1, gRPC v1.83.0, plus assorted transitive updates).
• Updated plugin modules (proto/antminer/virtual) to go 1.26, refreshed their dependency graphs, and advanced the internal server pseudo-version references.
• Updated tests/plugin-contract to gRPC v1.83.0 and refreshed transitive sums.

Reviewed changes

Copilot reviewed 5 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
server/go.mod	Bumps module go version to 1.26 and refreshes direct/indirect deps (notably etcd + gRPC).
server/go.sum	Updates checksum set to match the refreshed server dependency graph.
plugin/proto/go.mod	Bumps to go 1.26, updates internal server pseudo-version, and refreshes plugin proto deps (gRPC, moby, docker connections).
plugin/proto/go.sum	Updates checksums for the refreshed plugin/proto dependency graph.
plugin/antminer/go.mod	Bumps to go 1.26, updates internal server pseudo-version, and refreshes gRPC + transitive deps.
plugin/antminer/go.sum	Updates checksums for the refreshed plugin/antminer dependency graph.
plugin/virtual/go.mod	Bumps to go 1.26, updates internal server pseudo-version, and refreshes gRPC + transitive deps.
plugin/virtual/go.sum	Updates checksums for the refreshed plugin/virtual dependency graph.
tests/plugin-contract/go.mod	Updates gRPC + transitive deps (note: currently uses go 1.26.5 directive).
tests/plugin-contract/go.sum	Updates checksums for the refreshed contract test dependency graph.