chore(deps): Go 1.25.10; bump golang.org/x/crypto and x/term

Author: Cod-e-Codes

.github/workflows/go.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: '1.25.9'
+          go-version: '1.25.10'
 
       - name: Tidy modules
         run: go mod tidy
@@ -114,7 +114,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: '1.25.9'
+          go-version: '1.25.10'
 
       - name: Tidy modules
         run: go mod tidy

.github/workflows/release.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: '1.25.9'
+          go-version: '1.25.10'
 
       - name: Get build metadata
         id: metadata

CHANGELOG.md

@@ -8,6 +8,7 @@ On **`main`** only; not part of **[v1.0.0](https://github.com/Cod-e-Codes/marcha
 
 - **Packaging**: Sync **v1.0.0** zip SHA256 values in **PACKAGING.md**, **AUR**, Homebrew, Scoop, winget, and Chocolatey templates with hashes from published release assets.
 - **CI**: Downstream **AUR** publish job clones the packaging checkout over HTTPS instead of SSH.
+- **Toolchain / dependencies**: Go 1.25.10 in **go.mod**, CI, Docker, and docs; **golang.org/x/crypto** v0.51.0 and **golang.org/x/term** v0.43.0.
 - **Dependencies**: **github.com/jackc/pgx/v5** to 5.9.2; **modernc.org/sqlite** to 1.50.0; **github.com/go-sql-driver/mysql** to 1.10.0.
 - **Docs**: Changelog as the narrative hub; clearer onboarding via **QUICKSTART** and **docs/README**; refreshed coverage and LoC in **TESTING** and **README**; **CONTRIBUTING** and **PLUGIN_ECOSYSTEM** edits; call out **winget** and **Chocolatey** listings; link optional graphical clients from **README** and **PROTOCOL**; optional plugin discovery points at the **marchat-plugins** repository.
 - **Server**: Add `channel` column to the message schema for improved multi-channel flexibility; persist message channels so history replays into the correct channel. Persist direct messages with `recipient` metadata; reconnect history replays DMs only to sender and recipient. Typing with non-empty `recipient` uses the same DM delivery path as chat DMs.

CONTRIBUTING.md

@@ -23,7 +23,7 @@ Thank you for your interest in contributing. This guide explains how to contribu
 
 ## Local checks (match CI)
 
-From the repo root, with Go 1.25.9+, `golangci-lint`, and `govulncheck` on your `PATH`:
+From the repo root, with Go 1.25.10+, `golangci-lint`, and `govulncheck` on your `PATH`:
 
 ```bash
 gofmt -w .

Dockerfile

@@ -1,5 +1,5 @@
 # === Build Stage ===
-FROM golang:1.25.9-alpine AS builder
+FROM golang:1.25.10-alpine AS builder
 
 # Build arguments for version information
 ARG GIT_COMMIT

QUICKSTART.md

@@ -6,7 +6,7 @@ Get a **server** and **client** running in a few minutes. For full detail, see [
 
 - **Server**: `MARCHAT_ADMIN_KEY` (secret) and `MARCHAT_USERS` (comma-separated admin usernames). No other env vars are required for a local trial.
 - **Client**: A username and the WebSocket URL (default path is `/ws`).
-- **Optional**: [Go 1.25.9+](https://go.dev/dl/) only if you build from source; `openssl` (or any way to produce 64 hex chars) to generate the admin key.
+- **Optional**: [Go 1.25.10+](https://go.dev/dl/) only if you build from source; `openssl` (or any way to produce 64 hex chars) to generate the admin key.
 
 ## 1. Install binaries
 

README.md

@@ -219,7 +219,7 @@ go build -o marchat-client ./client
 ```
 
 **Prerequisites for source build:**
-- Go 1.25.9 or later ([download](https://go.dev/dl/))
+- Go 1.25.10 or later ([download](https://go.dev/dl/))
 - Linux clipboard support: `sudo apt install xclip` (Ubuntu/Debian) or `sudo yum install xclip` (RHEL/CentOS)
 
 **Terminal colors:** The server startup banner and the client’s pre-chat output (connection, E2E status, profile picker tags such as `[Admin]` / `[E2E]`, and auth prompts) use [lipgloss](https://github.com/charmbracelet/lipgloss) for emphasis. Set **`NO_COLOR=1`** (or **`NO_COLOR`**) in the environment to disable colors on plain stdout/stderr.

SECURITY.md

@@ -72,7 +72,7 @@ When the client **auto-generates** a global E2E key, it does **not** print the f
 
 Dependabot may flag **transitive** dependencies that do not expose reachable vulnerable APIs in marchat. For example, **CVE-2026-26958** ([GHSA-fw7p-63qq-7hpr](https://github.com/advisories/GHSA-fw7p-63qq-7hpr)) affects **`filippo.io/edwards25519`** before **v1.1.1** (`MultiScalarMult` receiver initialization). marchat does not use that API; the advisory notes many consumers (including typical **`github.com/go-sql-driver/mysql`** usage) are unaffected. The module is still pinned at **v1.1.1** on **`main`** to pick up the fix. For reachability, run **`govulncheck ./...`** against your build.
 
-**Go toolchain:** Build and release with **Go 1.25.9+** (see **`go.mod`**). Go **1.25.8** and earlier are flagged by **govulncheck** for several standard-library issues fixed in **1.25.9** (for example **GO-2026-4870** / **crypto/tls**, **GO-2026-4947** / **crypto/x509**, **GO-2026-4869** / **archive/tar**). **`github.com/jackc/pgx/v5`** (for example **GO-2026-4771** / **CVE-2026-33815** and **GO-2026-4772** / **CVE-2026-33816**) may still appear under **`govulncheck -show verbose`** for package-level advisories whose entries list **Fixed in: N/A**, even though upstream shipped related protocol hardening in **v5.9.0+**. Default **`govulncheck ./...`** reports **no reachable** vulnerable call paths in this module at current versions. Container image scanners (for example Docker Scout) often rely on similar metadata and flag **pgx** inside the compiled server binary without assessing reachability.
+**Go toolchain:** Build and release with **Go 1.25.10+** (see **`go.mod`**). Older **1.25.x** toolchains may be flagged by **govulncheck** for standard-library issues fixed in newer patches (for example **GO-2026-4870** / **crypto/tls**, **GO-2026-4947** / **crypto/x509**, **GO-2026-4869** / **archive/tar**); use the Go version pinned in **go.mod** and CI. **`github.com/jackc/pgx/v5`** (for example **GO-2026-4771** / **CVE-2026-33815** and **GO-2026-4772** / **CVE-2026-33816**) may still appear under **`govulncheck -show verbose`** for package-level advisories whose entries list **Fixed in: N/A**, even though upstream shipped related protocol hardening in **v5.9.0+**. Default **`govulncheck ./...`** reports **no reachable** vulnerable call paths in this module at current versions. Container image scanners (for example Docker Scout) often rely on similar metadata and flag **pgx** inside the compiled server binary without assessing reachability.
 
 ---
 

TESTING.md

@@ -113,7 +113,7 @@ Per-file statement percentages for important paths are listed under [Test Covera
 
 ### Prerequisites
 
-- Go 1.25.9 or later
+- Go 1.25.10 or later
 - SQLite support (built into Go)
 - PowerShell (for Windows test script)
 

deploy/CADDY-REVERSE-PROXY.md

@@ -23,7 +23,7 @@ marchat-client  --wss-->  localhost:8443  (Docker publishes host 8443 -> contain
 
 ## Prerequisites
 
-- **Go 1.25.9+** (for building from source).
+- **Go 1.25.10+** (for building from source).
 - **Docker** with **Compose v2** (Docker Engine on Linux; **Docker Desktop** on Windows or macOS is fine).
 - **marchat** repo cloned; server config directory **`config/`** exists.