[dependabot]

Bumps golang.org/x/sync from 0.24.0 to 0.25.0.

Commits

• 1f920df syncmap: rename DeepCopyMap to CopyMap
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7dcb008d-626d-4416-abb8-5793430579a5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[clawgenti]

Summary

This is a routine Dependabot minor bump of golang.org/x/sync from v0.24.0 to v0.25.0 in core. The dependabot-tidy commit (b1f1787) carries the bump into cmd/agentop, cmd/cortex, cmd/cortex-envoy and scripts/readme-demo, where it is an indirect dependency. The diff touches only go.mod and go.sum (10 files, +10/-10). The new h1: hash matches sum.golang.org. Upstream only changed test files in this release, so there is no functional change to the code the repo uses. No must-fix issues found.

Author: dependabot[bot] (CONTRIBUTOR, trusted automated dependency bot)
Areas reviewed: Go module manifests (go.mod/go.sum), module graph consistency, x/sync API usage, supply chain
Agent/IDE config (.claude/.vscode): none
Commits: 2 commits (the bump plus the dependabot-tidy chore: go mod tidy across modules), all signed-off: yes (DCO pass)
CI status: pending. On head b1f1787 only DCO has passed so far: 1 pass, 0 fail, 35 pending, and 2 skipped. The CI, Security Scans, Build-Publish and PR Verifier runs are queued.

• The pre-tidy commit a79ea5a had 8 failures: Verify module graph is tidy, Go CI for agentop, cortex, cortex-envoy, README demo, cpex, and macOS peerproc, plus the authbridge-lite build.
• Those are the expected stale-sibling go.mod/go.sum failures that the tidy commit fixes. I checked that every module builds with -mod=readonly at the head SHA.

Please confirm the head run goes green before merging.

Upstream / transitive check

• go directive: x/sync v0.25.0's go.mod declares go 1.26.0 and has no require block, the same as v0.24.0. Every affected module declares go 1.26.10, so that's fine.
• Transitive requirements: none. The /go.mod hash sUUOizhq… is the same in v0.24.0 and v0.25.0, so only the x/sync lines change.
• go.sum: h1:dJnifr0n… matches sum.golang.org (tree 71041485). The zip I rebuilt from tag v0.25.0 (1f920df1) gives the same h1:, and all five modules carry the same hash pair.
• Upstream changes: a single commit, syncmap: rename DeepCopyMap to CopyMap. It only touches _test.go files (syncmap/map_*_test.go, singleflight/singleflight_test.go). No exported API changed.
• Repo usage: only singleflight.Group, in core/sessionapi/timeline.go and core/plugins/sessionbudget/plugin.go. Nothing uses syncmap, errgroup or semaphore. Locally (Go 1.26.10, GOWORK=off):
  • go build ./... passes in core.
  • go vet (linux and darwin) and go test pass for sessionapi and plugins/sessionbudget.
  • Every module, including cmd/cortex with the local profile tags, builds with -mod=readonly at the head SHA.
• replace / siblings: the replace directives are unchanged. core/storage/redis does not depend on x/sync and is correctly left alone. This PR doesn't overlap the x/sys bumps in #1753 and #1754 (they edit adjacent go.mod/go.sum lines), so whichever merges later may need a Dependabot rebase.

[clawgenti]

Summary

This is a routine Dependabot minor bump of golang.org/x/sync from v0.24.0 to v0.25.0. Dependabot bumped it in /core (a79ea5a), and the dependabot-tidy workflow (b1f1787) carried it into cmd/cortex, cmd/cortex-envoy, cmd/agentop and scripts/readme-demo. The diff is 10 files, +15/-15, and every changed line is an x/sync line in go.mod/go.sum. Upstream has no non-test code changes between these tags. I found no must-fix issues.

Author: dependabot[bot] (CONTRIBUTOR, trusted automated dependency bot)
Areas reviewed: Go module manifests (go.mod/go.sum across 5 modules), supply chain, and the core packages that import x/sync
Agent/IDE config (.claude/.vscode): none
Commits: 2 commits, all signed-off: yes (DCO pass). a79ea5a is the Dependabot bump. b1f1787 is chore: go mod tidy across modules from the dependabot-tidy workflow.
CI status: passing on head b1f1787. 70 checks succeeded and none failed, including Go CI (core), Go CI (core peerproc, macOS), Go CI (cpex plugin, cgo), Go CI (README demo), Verify module graph is tidy and every build-and-push image. The failures on the first commit (a79ea5a: tidy check, README demo lint, peerproc macOS, cpex, build-and-push (authbridge-lite)) were the expected pre-tidy breakage. I reproduced it locally: at a79ea5a, GOWORK=off go build ./... in cmd/cortex and scripts/readme-demo fails with updates to go.mod needed. The tidy commit fixes it.

Upstream / transitive check

• v0.24.0...v0.25.0 is a single commit, 1f920df syncmap: rename DeepCopyMap to CopyMap. It touches only _test.go files (syncmap/map_bench_test.go, map_reference_test.go, map_test.go, plus removing a tc := tc in singleflight/singleflight_test.go). No exported API or runtime code changed.
• x/sync's go.mod is the same in both tags (go 1.26.0, no requirements). The /go.mod h1:sUUOizhq… line is unchanged, so nothing transitive moves. This repo's modules declare go 1.26.10, so there's no Go version bump.
• go.sum: h1:dJnifr0nMV8/SBnBvdo4eSGGnrc3O4FFx6IqvtLcmRs= matches sum.golang.org, and it's the same in all 5 modules. No module still references v0.24.0. All six modules in go.work that use x/sync are now on v0.25.0.
• Core uses errgroup, semaphore and singleflight (from plugins/contextguru, plugins/opa, plugins/sessionbudget and sessionapi). None of these packages changed.

Local verification on the PR head (go1.26.10)

• go mod verify passes in all 5 modules.
• go build ./... succeeds in all 5 modules, both with the workspace and with GOWORK=off.
• go vet ./... is clean in cmd/cortex and scripts/readme-demo.
• go test -race passes for every core package that depends on x/sync: plugins/contextguru, plugins/opa, plugins/sessionbudget and sessionapi.
• go mod tidy -diff is clean in cmd/agentop and scripts/readme-demo. In the other three modules, the only differences came from a module zip that my sandbox couldn't download. There were none for x/sync, and CI's tidy check passes on the head.

Note (non-blocking): sibling PRs #1751, #1752 and #1753 also edit core/go.mod/go.sum and the cmd/* go.sum files, so whichever merge later will need a Dependabot rebase. The hunks touch different lines, so clean rebases are likely.