chore(server): update Go dependencies

[hanzei]

Routine server/ dependency sweep via /update-server-deps. Four commits, one per batch, each built, tested and linted on its own so a regression bisects cleanly.

Direct dependencies moved

Module	From	To
github.com/go-chi/chi/v5	v5.3.1	v5.3.2
github.com/sirupsen/logrus	v1.9.4	v1.10.1
github.com/stretchr/testify	v1.11.1	v1.12.1
golang.org/x/crypto	v0.54.0	v0.55.0
golang.org/x/image	v0.44.0	v0.45.0
go.opentelemetry.io/otel + stable line	v1.44.0	v1.45.0
go.opentelemetry.io/otel/log + log line	v0.20.0	v0.21.0
go.opentelemetry.io/otel/exporters/prometheus	v0.66.0	v0.67.0
go.opentelemetry.io/contrib/bridges/otellogrus	v0.19.0	v0.20.0
go.opentelemetry.io/contrib/instrumentation/*	v0.69.0	v0.70.0
google.golang.org/grpc	v1.82.1	v1.83.1
modernc.org/sqlite	v1.55.0	v1.57.0
github.com/golangci/golangci-lint/v2 (tool)	v2.12.2	v2.13.1

github.com/swaggo/swag stays at v1.16.6 — already current on the v1 line, and server/docs/ regenerates byte-identical.

No source changes were needed anywhere in this PR.

Notes on the riskier bumps

OpenTelemetry v1.45.0 — all three version lines plus contrib move together, as they must. Neither v1.45.0 breaking change reaches this code:

• The otel/log API removals (Kind, Value, KeyValue) affect record construction, which happens inside the otellogrus bridge; internal/telemetry only names the log.LoggerProvider interface.
• OTLP exporters no longer append default signal paths to a path-less HTTP endpoint. Every exporter here is gRPC, so this is inert.

grpc moved in the same commit rather than separately because the v1.45.0 OTLP gRPC exporters require grpc >= v1.83.0 — holding it back was not an option.

Beyond the test suite, I ran the server with all three signals enabled against the stdout exporter and confirmed traces (POST /api/v1/*, NoteStore.PurgeOldTrashedNotes), 31 log records through the otellogrus bridge, and metrics all emit with no export errors. Worth doing explicitly here: mismatched OTel version lines compile fine and fail at runtime.

modernc.org/sqlite v1.57.0 — the production database driver. v1.56.0 was a re-vendor plus a libc bump; v1.57.0 promoted freebsd/386, freebsd/arm and netbsd/amd64. The embedded SQLite engine version is unchanged, so there is no on-disk format change and no action needed for existing installations.

logrus v1.10.1 — first minor in years, so flagging the one user-visible change: TextFormatter now renders []byte as quoted strings rather than numeric slices, and debug/trace lines get slightly different colors on a TTY. Server log content is otherwise unchanged. Minimum Go is now 1.23, well below this repo's floor.

golangci-lint v2.13.1 — no .golangci.yml changes were needed: the config schema still validates and the suite reports 0 issues, so no linter was renamed, removed, or newly triggered here.

go mod tidy also moved github.com/quasilyte/go-ruleguard/dsl out of the indirect block — server/gorules/rules.go imports it directly, so the previous // indirect marking was simply stale.

Held back deliberately

Go 1.27.0. It is released, but nothing in this sweep requires it, and the go directive is a minimum-version floor for anyone building Jot from source — 1.27.0 currently has no patch release. Keeping it out also keeps a toolchain change from riding along in a dependency diff. When it is taken, it needs all eight locations in one go: server/go.mod, both workflows, the Dockerfile digest, README.md, and three spots in CLAUDE.md.

Verification

• task check — full pre-PR gate, passing (lint, all tests, docs, migration parity, translations)
• task test-e2e — 393 passed, 3 skipped
• task build-jotctl — builds and runs
• task gen-docs — no drift in server/docs/
• Postgres path — the store and migration suites that skip by default were run against a real PostgreSQL 16 with TEST_POSTGRES_DSN set: 0 skips, 0 failures. This is what actually covers the lib/pq and golang-migrate paths a driver bump can break.
• govulncheck — no vulnerabilities affecting this code. One module-level advisory (GO-2026-5932, x/crypto/openpgp unmaintained) is unreachable: Jot uses x/crypto/bcrypt, and there is no fixed version to move to.

API and compatibility

No API-breaking changes; no endpoint, schema, or migration changes. Backend-only, so there is no visual artifact to attach.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 19 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a06ef4b-9bb5-465f-8704-754f5174b4e8

📥 Commits

Reviewing files that changed from the base of the PR and between 2c037ac and c9023d5.

⛔ Files ignored due to path filters (1)

• server/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• server/go.mod

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}