chore(deps): patch+minor dependency updates 2026-04-20

[jasonmassie01]

Dependency Updates — 2026-04-20

Automated patch + minor bumps. Majors are tracked as separate issues.

All changes pass go build ./..., npm run build, and go test -count=1 -short -timeout 60s ./....

Changes

Ecosystem	Package	Old	New	Kind
Go	github.com/fsnotify/fsnotify	v1.7.0	v1.9.0	minor
Go	github.com/jackc/pgx/v5	v5.7.2	v5.9.2	minor
Go	golang.org/x/crypto	v0.31.0	v0.50.0	minor
Go	golang.org/x/sync	v0.10.0	v0.20.0	minor
Go	golang.org/x/sys	v0.28.0	v0.43.0	minor
Go	golang.org/x/text	v0.21.0	v0.36.0	minor
Go	go toolchain	1.24	1.25.0	minor (required by pgx v5.9.2)
npm	eslint-plugin-react-hooks	7.0.1	7.1.1	minor
npm	globals	17.4.0	17.5.0	minor
npm	lucide-react	1.7.0	1.8.0	minor
npm	react	19.2.4	19.2.5	patch
npm	react-dom	19.2.4	19.2.5	patch
npm	vite	8.0.3	8.0.9	patch

Skipped (major — see issues)

Ecosystem	Package	Old	New
npm	@eslint/js	9.39.4	10.0.1
npm	@vitest/coverage-v8	3.2.4	4.1.4
npm	eslint	9.39.4	10.2.1
npm	jsdom	25.0.1	29.0.2
npm	vitest	3.2.4	4.1.4

https://claude.ai/code/session_01Wvri4Tw3JQyYWwSmHWVGeE

[jasonmassie01]

pg-sage auto-review v1

Summary

Automated patch/minor dependency bump touching only sidecar/go.mod, go.sum, web/package.json, package-lock.json, and the rebuilt frontend dist bundle (old content-hashed JS deleted, new one added, index.html updated). No .go source files were changed. The notable non-trivial changes are pgx/v5 v5.7.2 → v5.9.2 and the Go toolchain raised to 1.25.0 (required by the new pgx).

Findings

Critical (0)

Warning (1)

• sidecar/go.mod:3 — go 1.25.0 sets the hard minimum Go version for the module. Unlike a separate toolchain directive (advisory), the go line causes Go 1.24 to refuse to build entirely. The PR description correctly labels this "required by pgx v5.9.2," so the bump is unavoidable if upgrading pgx—but CI, README, and contributor docs should be updated to document Go ≥ 1.25 as a build requirement.

Nit (1)

• sidecar/internal/api/dist/ — Committing built frontend assets is an established pattern in this repo. The swap is clean: index-ecBLX5R2.js deleted, index-BNRL5ZIQ.js added, index.html reference updated to match. No stale files left behind. No action needed—just confirming the swap is correct.

---

Generated by Claude Code