feat(deps): updated go libs. Fixed snyk and versioning issues

.github/workflows/build.yml

@@ -7,7 +7,7 @@
 name: "wallet-sdk ci"
 
 env:
-  GO_VERSION: '1.23.4'
+  GO_VERSION: '1.25.3'
 
 on:
   push:
@@ -97,8 +97,8 @@ jobs:
       - name: Build docker images for test server
         run: |
           docker build -f ./images/mocks/loginconsent/Dockerfile --no-cache -t wallet-sdk/mock-login-consent:latest \
-          --build-arg GO_VER=1.23 \
-          --build-arg ALPINE_VER=3.20 .
+          --build-arg GO_VER=1.25 \
+          --build-arg ALPINE_VER=3.22 .
       - name: Save docker image as tar
         run: |
           docker save --output /tmp/mock-login-consent.tar wallet-sdk/mock-login-consent
@@ -120,8 +120,8 @@ jobs:
       - name: Build docker images for test server
         run: |
           docker build -f ./images/mocks/webhook/Dockerfile --no-cache -t wallet-sdk/sample-webhook:latest \
-          --build-arg GO_VER=1.23 \
-          --build-arg ALPINE_VER=3.20 .
+          --build-arg GO_VER=1.25 \
+          --build-arg ALPINE_VER=3.22 .
       - name: Save docker image as tar
         run: |
           docker save --output /tmp/mock-sample-webhook.tar wallet-sdk/sample-webhook
@@ -143,8 +143,8 @@ jobs:
       - name: Build docker images for test server
         run: |
           docker build -f ./images/mocks/trustregistry/Dockerfile --no-cache -t wallet-sdk/mock-trust-registry:latest \
-          --build-arg GO_VER=1.23 \
-          --build-arg ALPINE_VER=3.20 .
+          --build-arg GO_VER=1.25 \
+          --build-arg ALPINE_VER=3.22 .
       - name: Save docker image as tar
         run: |
           docker save --output /tmp/mock-trust-registry.tar wallet-sdk/mock-trust-registry
@@ -166,8 +166,8 @@ jobs:
       - name: Build docker images for test server
         run: |
           docker build -f ./images/mocks/attestation/Dockerfile --no-cache -t wallet-sdk/mock-attestation:latest \
-          --build-arg GO_VER=1.23 \
-          --build-arg ALPINE_VER=3.20 .
+          --build-arg GO_VER=1.25 \
+          --build-arg ALPINE_VER=3.22 .
       - name: Save docker image as tar
         run: |
           docker save --output /tmp/mock-attestation.tar wallet-sdk/mock-attestation
@@ -209,12 +209,17 @@ jobs:
           echo '127.0.0.1 vc-rest-echo.trustbloc.local' | sudo tee -a /etc/hosts
           echo '127.0.0.1 api-gateway.trustbloc.local' | sudo tee -a /etc/hosts
           echo '127.0.0.1 cognito-mock.trustbloc.local' | sudo tee -a /etc/hosts
-      - name: Install and start docker
-        uses: douglascamata/setup-docker-macos-action@v1-alpha
+      - name: Install and start Docker (Colima)
+        uses: douglascamata/setup-docker-macos-action@v1
         with:
-          upgrade-qemu: false
           lima: v1.0.4
           colima: v0.8.1
+          colima-network-address: false
+      - name: Verify Docker/Colima
+        run: |
+          docker version
+          colima status
+          docker run --rm hello-world || true
       - name: Download artifacts (Docker images) from previous workflows
         uses: actions/download-artifact@v4
       - name: Load mock-login-consent server
@@ -296,12 +301,17 @@ jobs:
           echo '127.0.0.1 vc-rest-echo.trustbloc.local' | sudo tee -a /etc/hosts
           echo '127.0.0.1 api-gateway.trustbloc.local' | sudo tee -a /etc/hosts
           echo '127.0.0.1 cognito-mock.trustbloc.local' | sudo tee -a /etc/hosts
-      - name: Install and start docker
+      - name: Install and start Docker (Colima)
         uses: douglascamata/setup-docker-macos-action@v1-alpha
         with:
-          upgrade-qemu: false
           lima: v1.0.4
           colima: v0.8.1
+          colima-network-address: false
+      - name: Verify Docker/Colima
+        run: |
+          docker version
+          colima status
+          docker run --rm hello-world || true
       - name: Download artifacts (Docker images) from previous workflows
         uses: actions/download-artifact@v4
       - name: Load mock-login-consent server

.github/workflows/release.yml

@@ -7,7 +7,7 @@
 name: "wallet-sdk release"
 
 env:
-  GO_VERSION: '1.23'
+  GO_VERSION: '1.25'
 
 on:
   push:
@@ -32,7 +32,7 @@ jobs:
           cd ..
           git clone https://go.googlesource.com/go goroot
           cd goroot
-          git checkout go1.23.4
+          git checkout go1.25.3
           cp ../wallet-sdk/cmd/wallet-sdk-gomobile/gopatches/* ./
           git revert 3560cf0afb3c29300a6c88ccd98256949ca7a6f6
           cd src && ./make.bash
@@ -98,7 +98,7 @@ jobs:
           cd ..
           git clone https://go.googlesource.com/go goroot
           cd goroot
-          git checkout go1.23.4
+          git checkout go1.25.3
           cp ../wallet-sdk/cmd/wallet-sdk-gomobile/gopatches/* ./
           git revert 3560cf0afb3c29300a6c88ccd98256949ca7a6f6
           cd src && ./make.bash

.golangci.yml

@@ -1,8 +1,4 @@
-#
-# Copyright Avast Software. All Rights Reserved.
-#
-# SPDX-License-Identifier: Apache-2.0
-#
+version: 2
 
 run:
   concurrency: 4
@@ -13,9 +9,11 @@ run:
 
 output:
   formats:
-    - format: colored-line-number
-  print-issued-lines: true
-  print-linter-name: true
+    text:
+      path: stdout
+      print-issued-lines: true
+      print-linter-name: true
+      colors: true
 
 linters-settings:
   errcheck:
@@ -77,13 +75,11 @@ linters:
     - cyclop # TODO consider replacing gocyclo with cyclop
     - wrapcheck # TODO enable
     - forbidigo # TODO enable
-    - gci # giving spurious errors for imports of syscall/js
     - exhaustruct # Results in unneeded struct member declarations
     - ireturn # Required by aries-framework-go, a library we use
     - tagliatelle # JSON tags using camel-case required by the specs we implement
     - varnamelen # This linter prevents us from using "i" as an index variable or "vc" for a variable name for a Verifiable Credential, both of which are very common in our code
     - depguard # TODO consider enabling in the future
-    - exportloopref
     - revive
     - perfsprint
     - thelper

Makefile

@@ -12,9 +12,9 @@ else
 	PATH:=$(PATH);$(subst /,\\,$(GOBIN_PATH))
 endif
 
-ALPINE_VER ?= 3.20
-GO_ALPINE_VER ?= 3.20
-GO_VER ?= 1.23
+ALPINE_VER ?= 3.22
+GO_ALPINE_VER ?= 3.22
+GO_VER ?= 1.25
 
 NEW_VERSION ?= $(shell git describe --tags --always `git rev-list --tags --max-count=1`)-SNAPSHOT-$(shell git rev-parse --short=7 HEAD)
 GIT_REV ?= $(shell git rev-parse HEAD)

build.gradle

@@ -6,6 +6,7 @@
 
 apply plugin: 'maven-publish' 
 
+
 publishing {
   publications {
     bar(MavenPublication) {

cmd/wallet-sdk-gomobile/README.md

@@ -4,7 +4,7 @@ This package contains the `gomobile`-compatible version of the SDK. It acts as a
 
 ## Prerequisites
 
-* [Go 1.23](https://go.dev/doc/install) or newer
+* [Go 1.25](https://go.dev/doc/install) or newer
 * The gomobile tools:
   ```
   go install golang.org/x/mobile/cmd/gomobile@latest

cmd/wallet-sdk-gomobile/go.mod

@@ -5,86 +5,84 @@
 
 module github.com/trustbloc/wallet-sdk/cmd/wallet-sdk-gomobile
 
-go 1.23.0
-
-toolchain go1.23.6
+go 1.25.3
 
 require (
 	github.com/go-jose/go-jose/v3 v3.0.4
 	github.com/google/uuid v1.6.0
 	github.com/gowebpki/jcs v1.0.1
 	github.com/piprate/json-gold v0.5.1-0.20230111113000-6ddbe6e6f19f
-	github.com/stretchr/testify v1.10.0
-	github.com/trustbloc/did-go v1.3.4
-	github.com/trustbloc/kms-go v1.2.2
-	github.com/trustbloc/vc-go v1.3.3
+	github.com/stretchr/testify v1.11.1
+	github.com/trustbloc/did-go v1.3.5
+	github.com/trustbloc/kms-go v1.2.3
+	github.com/trustbloc/vc-go v1.3.4
 	github.com/trustbloc/wallet-sdk v0.0.0-00010101000000-000000000000
 )
 
 require (
+	github.com/consensys/bavard v0.2.1 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/theory/jsonpath v0.3.0 // indirect
+	github.com/mmcloughlin/addchain v0.4.0 // indirect
+	github.com/theory/jsonpath v0.10.2 // indirect
+	lukechampine.com/blake3 v1.4.1 // indirect
+	rsc.io/tmplfunc v0.0.3 // indirect
 )
 
 require (
 	github.com/IBM/mathlib v0.0.3-0.20231011094432-44ee0eb539da // indirect
 	github.com/PaesslerAG/gval v1.2.4 // indirect
 	github.com/PaesslerAG/jsonpath v0.1.2-0.20240726212847-3a740cf7976f // indirect
-	github.com/VictoriaMetrics/fastcache v1.12.2 // indirect
-	github.com/bits-and-blooms/bitset v1.17.0 // indirect
-	github.com/btcsuite/btcd/btcec/v2 v2.3.4 // indirect
+	github.com/VictoriaMetrics/fastcache v1.13.0 // indirect
+	github.com/bits-and-blooms/bitset v1.24.3 // indirect
+	github.com/btcsuite/btcd/btcec/v2 v2.3.6 // indirect
 	github.com/btcsuite/btcutil v1.0.3-0.20201208143702-a53e38424cce // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/consensys/bavard v0.1.22 // indirect
-	github.com/consensys/gnark-crypto v0.14.0 // indirect
+	github.com/consensys/gnark-crypto v0.17.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
-	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
+	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/golang/snappy v0.0.4 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/tink/go v1.7.0 // indirect
 	github.com/hyperledger/fabric-amcl v0.0.0-20230602173724-9e02669dceb2 // indirect
 	github.com/kawamuray/jsonpath v0.0.0-20210127151053-2ab0d7f0a6ad // indirect
 	github.com/kilic/bls12-381 v0.1.1-0.20210503002446-7b7597926c69 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.3 // indirect
-	github.com/minio/blake2b-simd v0.0.0-20160723061019-3f5f724cb5b1 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mmcloughlin/addchain v0.4.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
 	github.com/multiformats/go-multibase v0.2.0 // indirect
-	github.com/multiformats/go-multihash v0.0.14 // indirect; (breaking changes)
-	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/multiformats/go-multihash v0.2.3 // indirect; (breaking changes)
+	github.com/multiformats/go-varint v0.1.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/pquerna/cachecontrol v0.2.0 // indirect
-	github.com/samber/lo v1.47.0 // indirect
+	github.com/samber/lo v1.52.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/teserakt-io/golang-ed25519 v0.0.0-20210104091850-3888c087a4c8 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
-	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/match v1.2.0 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
-	github.com/tidwall/sjson v1.1.7 // indirect; (breaking changes)
-	github.com/trustbloc/bbs-signature-go v1.0.2 // indirect
-	github.com/trustbloc/sidetree-go v1.1.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect; (breaking changes)
+	github.com/trustbloc/bbs-signature-go v1.0.3 // indirect
+	github.com/trustbloc/sidetree-go v1.1.2 // indirect
 	github.com/veraison/go-cose v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	golang.org/x/crypto v0.37.0 // indirect
-	golang.org/x/exp v0.0.0-20241204233417-43b7b7cde48d // indirect
-	golang.org/x/oauth2 v0.24.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
-	golang.org/x/text v0.24.0 // indirect
-	google.golang.org/protobuf v1.35.2 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
+	golang.org/x/oauth2 v0.31.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	rsc.io/tmplfunc v0.0.3 // indirect
 )
 
 replace github.com/trustbloc/wallet-sdk => ../../