chore(deps): consolidated dependency refresh

[devarismeroxa]

Bumps the main module's outstanding dependency updates in one green, tidied change instead of merging several behind-main dependabot PRs whose CI was failing only on stale lint/generated-file checks.

Direct

• google.golang.org/grpc 1.80.0 → 1.81.0 (supersedes go.mod: bump google.golang.org/grpc from 1.80.0 to 1.81.0 #2495)
• github.com/grpc-ecosystem/grpc-gateway/v2 2.28.0 → 2.29.0 (supersedes go.mod: bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.28.0 to 2.29.0 #2486)

Indirect (security / transitive)

• golang.org/x/net 0.49.0 → 0.55.0 (supersedes go.mod: bump golang.org/x/net from 0.49.0 to 0.55.0 #2501)
• github.com/jackc/pgx/v5 5.7.5 → 5.9.2 (supersedes go.mod: bump github.com/jackc/pgx/v5 from 5.7.5 to 5.9.2 #2490)
• github.com/apache/thrift 0.16.0 → 0.23.0 (supersedes go.mod: bump github.com/apache/thrift from 0.16.0 to 0.23.0 #2496)
• go.opentelemetry.io/otel 1.41 → 1.43, golang.org/x/crypto 0.47 → 0.51, and related golang.org/x updates pulled transitively.

Notable: go directive 1.24.2 → 1.25.0

Forced by grpc 1.81, x/net 0.55, otel 1.43, and grpc-gateway 2.29, which all now require go 1.25. This raises the minimum Go to build Conduit — flagging for visibility.

Deliberately excluded (handled separately)

• cohere-go 2.14.1 → 2.18.0 (go.mod: bump github.com/cohere-ai/cohere-go/v2 from 2.14.1 to 2.18.0 #2448): a breaking API change (cohere.UserMessage, V2RerankRequest.ReturnDocuments) requiring a code migration in the cohere builtin processor. That's why go.mod: bump github.com/cohere-ai/cohere-go/v2 from 2.14.1 to 2.18.0 #2448's test check genuinely fails, unlike the stale-lint failures on the others.
• tools-module bumps (Go tools: Bump golang.org/x/crypto from 0.37.0 to 0.45.0 in /tools #2411 x/crypto, Go tools: Bump github.com/docker/cli from 28.0.4+incompatible to 29.2.0+incompatible in /tools #2440 docker/cli, Go tools: Bump golang.org/x/net from 0.53.0 to 0.55.0 in /tools #2500 x/net): // indirect dev-tooling deps that go mod tidy reverts and that aren't in the shipped binary; the main-module x/net bump above already covers the shipped-binary exposure.

Verification

go build ./..., go vet, and unit tests for pkg/http, pkg/schemaregistry, pkg/foundation all pass; go mod verify clean.

Risk tier

Tier 3 (deps). Automated gates apply.

🤖 Generated with Claude Code

[devarismeroxa]

Closing this. Investigation showed the premise (a simple consolidated dependency refresh) doesn't hold: every current version of the core deps (grpc, grpc-gateway, x/net, otel, pgx, thrift) now declares go 1.25.0, so any of these bumps forces the module go directive to 1.25 — which in turn requires bumping the CI toolchain (golangci-lint, gofumpt, x/tools) and surfaces 34 pre-existing lint issues.

That's a deliberate Go 1.25 upgrade, not a routine refresh, so it's tracked properly in #2506 (with the full diagnosis, toolchain versions, and the list of surfaced fixes). The dependabot go.mod PRs this was meant to supersede will be resolved by that upgrade.