fix(deps): resolve critical CVEs in Go and npm dependencies

[fishman]

Go (server/go.mod):

• Bump go toolchain 1.22.3 -> 1.25.0 (CVE-2025-68121, CVE-2025-22871, CVE-2024-24790)
• Bump google.golang.org/grpc v1.64.0 -> v1.82.1 (CVE-2026-33186)
• Bump golang.org/x/net v0.27.0 -> v0.57.0 (CVE-2026-39821)

npm:

• Bump hbs 4.2.0 -> 4.2.1, pulls handlebars 4.7.9 (CVE-2026-33937)
• Bump socket.io 4.7.4 -> 4.8.3 (CVE-2026-54466 via websocket-driver)
• Add pnpm overrides for websocket-driver, shell-quote, immutable
  (CVE-2026-54466, CVE-2026-9277, CVE-2026-29063)

Summary by CodeRabbit

• Chores
  • Updated underlying application and server components to newer supported versions.
  • Improved compatibility across web, real-time communication, and backend services.
  • Standardized selected package versions to support more consistent builds and deployments.
  • Updated server tooling requirements and refreshed supporting libraries.

[hami-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fishman

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 71c8e35e-4f4e-49fc-9571-26bfa29c227b

📥 Commits

Reviewing files that changed from the base of the PR and between c59f776 and d2ace08.

⛔ Files ignored due to path filters (2)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• server/go.sum is excluded by !**/*.sum

📒 Files selected for processing (3)

• package.json
• pnpm-workspace.yaml
• server/go.mod

---

📝 Walkthrough

Walkthrough

Updated JavaScript dependency versions and pnpm overrides, raised the Go toolchain version, and refreshed Go module classifications and indirect dependency versions.

Changes

Dependency and Toolchain Refresh

Layer / File(s)	Summary
JavaScript dependency updates package.json, pnpm-workspace.yaml	hbs and socket.io were upgraded, and overrides were added for websocket-driver, shell-quote, and immutable.
Go toolchain and module updates server/go.mod	The Go version was raised to 1.25.0, dependencies were reclassified, and multiple indirect module versions were refreshed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: enhancement

Poem

I’m a rabbit with packages tucked in my den,
Fresh versions hop in, then hop out again.
Go’s toolchain grows tall, modules align,
Overrides sparkle in neat little lines.
A dependency dance—crisp, quick, and fine!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency security updates across Go and npm packages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-critical-security-issues

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

package.json

ESLint skipped: missing config or dependency (missing-dependency). The ESLint configuration references a package that is not available in the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}