chore(wren-launcher): fix security issue

[cyyeh]

Summary by CodeRabbit

• Chores
  • Updated Go language version and toolchain specification.
  • Upgraded multiple dependencies to newer versions, including Docker, AWS SDK, containerd, Prometheus, Kubernetes, and OpenTelemetry libraries.
  • Added and removed several indirect dependencies as part of the update.

[coderabbitai]

Walkthrough

The Go module file for the wren-launcher project was updated to increase the Go language version and specify a newer toolchain. Numerous dependencies were upgraded to more recent versions, including key libraries related to Docker, AWS SDK, Kubernetes, containerd, Prometheus, and OpenTelemetry. Some dependencies were replaced with newer modules, and several new indirect dependencies were added or removed due to transitive updates. No changes were made to the module path or to the declarations of any exported or public entities.

Changes

File(s)	Change Summary
wren-launcher/go.mod	Bumped Go version from 1.23.0 to 1.23.8, specified toolchain as Go 1.24.1, upgraded numerous dependencies (Docker Compose, Docker, AWS SDK, containerd, Prometheus, Kubernetes, OpenTelemetry, etc.), replaced some dependencies with newer modules, and updated indirect dependencies. No changes to exported/public entity declarations.

Poem

In the meadow of modules, dependencies bloom,
With Docker and AWS, we sweep out the gloom.
Kubernetes hops higher, OpenTelemetry in tow,
Fresh toolchains and libraries, onward we go!
The launcher leaps forward, with versions anew—
A rabbit’s delight, in code that’s true.
🐇✨

---

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4d454cc and cd096f8.

⛔ Files ignored due to path filters (1)

• wren-launcher/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• wren-launcher/go.mod (2 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• wren-launcher/go.mod

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (3)

wren-launcher/go.mod (3)

24-24: Review secret-detector integration
Adding github.com/DefangLabs/secret-detector enhances security scanning. Consider wiring it into your CI pipeline or pre‑commit hooks to automatically flag exposed secrets, and validate its performance overhead on large repositories.

---

208-214: Consolidate redundant OpenTelemetry requires
You list OTLP and core OTEL modules in both require blocks. Consider collapsing them into a single block to reduce duplication and improve readability.

---

1-219: Prune and tidy dependencies
After a bulk upgrade, run go mod tidy (and go mod vendor if vendoring) to remove unused modules, keep go.sum minimal, and ensure deterministic builds.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4efb977 and 4d454cc.

⛔ Files ignored due to path filters (1)

• wren-launcher/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• wren-launcher/go.mod (2 hunks)

🔇 Additional comments (11)

wren-launcher/go.mod (11)

3-5: Ensure Go version and toolchain compatibility
You’ve bumped the go directive to 1.23.8 and set toolchain go1.24.1. Please verify that your CI runners and developer machines are updated to Go 1.24.1 to avoid build or module resolution mismatches.

---

9-10: Validate updated Docker Compose and Docker client versions
Direct dependencies on github.com/docker/compose/v2 v2.35.1 and github.com/docker/docker v28.1.0+incompatible represent significant jumps. These may introduce breaking API changes—double‑check your import paths, client calls, and run integration tests against a live Docker daemon.

---

28-40: Verify AWS SDK for Go v2 upgrades
Multiple github.com/aws/aws-sdk-go-v2/... modules were bumped. Ensure no API signature changes affect your code, especially around configuration loading and SSO. Running end‑to‑end flows (real or mocked) against AWS will help catch regressions.

---

48-52: Check containerd major version bump path
You’ve upgraded to github.com/containerd/containerd/v2 v2.0.4 (and related errdefs/pkg). Major version bumps require import‑path changes. Confirm your code references /v2 paths and adjust usage accordingly.

---

71-72: JWT library v5 upgrade
github.com/golang-jwt/jwt/v5 v5.2.2 is a major version bump. If you consume JWTs, review the new API surface (token creation/parsing) for any signature changes, update your code, and re‑run auth flows.

---

124-127: Prometheus client libraries updated
Indirect bumps to client_golang, client_model, common, and procfs could change metrics naming or behavior. Validate your metric emission and scrape endpoints to ensure no metrics are dropped or reformatted.

---

134-136: CLI and testing framework upgrades
Indirect updates to spf13/cobra v1.9.1, spf13/pflag v1.0.6, and stretchr/testify v1.10.0 may introduce new flags, deprecations, or assertion changes. Run your CLI integration tests and unit tests to surface any breakages.

---

148-156: Align OpenTelemetry SDK and exporters versions
You’ve bumped many go.opentelemetry.io/... modules to v1.31–v1.34. There have been API changes in metrics and tracing; ensure your initialization, exporter configuration, and instrumentation still function as expected.

---

165-166: Confirm gRPC and Protobuf versions
google.golang.org/grpc v1.71.1 and google.golang.org/protobuf v1.36.4 may affect interceptors, code generation, and wire compatibility. Re‑generate any .pb.go files and run your RPC smoke tests.

---

171-174: Kubernetes client and API upgrades
Bumping k8s.io/api, k8s.io/apimachinery, and k8s.io/client-go to v0.31.2 introduces new generated types and client changes. Update CRD imports, re‑run code generators, and validate cluster interactions.

---

188-188: Validate direct docker/cli version bump
The second require block updates github.com/docker/cli v28.1.0+incompatible. If you import CLI internals, confirm your commands and structures still exist or adjust to new paths.