chore(deps): bump x/net to v0.57.0, raise Go floor to 1.25.12, add govulncheck CI

Addresses two dependency-floor findings:

5. golang.org/x/net v0.54.0 carried ~7 published advisories (fixed in
   v0.55.0/v0.56.0). None were reachable through odek's call graph, but the
   constraint permitted the vulnerable version. Bumped to v0.57.0 (with
   x/term v0.45.0 and x/sys v0.47.0 as required companions) and added a
   govulncheck job to CI so future advisories fail the build.

6. go.mod declared go 1.25.0; scanning with early 1.25.x toolchains traces
   22 reachable stdlib CVEs (crypto/tls, crypto/x509, net/http, net/url,
   net, os, encoding/pem, encoding/asn1), fixed across Go 1.25.2-1.25.12.
   Raised the go directive to 1.25.12 (verified as the latest 1.25.x patch
   via go.dev/dl) and stated the minimum build toolchain in the README,
   docs/DEVELOPMENT.md, and the test/release workflows.

Verified: govulncheck reports zero reachable module vulnerabilities after
the bump; the single remaining local stdlib report (GO-2026-5856) is fixed
in exactly 1.25.12 per the vuln DB and only appears because the local
scanning toolchain (go1.26.4) is one patch behind. Full test suite, vet,
and golangci-lint pass with the bumped dependencies.

Author: jkyberneees

.github/workflows/release.yml

@@ -16,6 +16,8 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
+          # Minimum supported build toolchain is Go 1.25.12 (go.mod floor);
+          # "1.25" resolves to the latest 1.25.x patch release.
           go-version: "1.25"
 
       - name: build

.github/workflows/test.yml

@@ -14,6 +14,8 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
+          # Minimum supported build toolchain is Go 1.25.12 (go.mod floor);
+          # "1.25" resolves to the latest 1.25.x patch release.
           go-version: "1.25"
 
       - name: build
@@ -42,3 +44,19 @@ jobs:
         with:
           version: v2.12.2
           args: --timeout=10m
+
+  vuln:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          # Latest stable toolchain: stdlib advisories are assessed against
+          # the newest patch release, and module advisories (e.g. x/net) are
+          # toolchain-independent. The go.mod floor (go 1.25.12) pins the
+          # minimum toolchain for downstream builders.
+          go-version: "stable"
+
+      - name: govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

README.md

@@ -5,7 +5,7 @@
 One binary. One loop. Zero frameworks. ReAct (Reasoning + Acting) — think, therefore act.
 
 ```bash
-# Install
+# Install (requires Go ≥ 1.25.12 — see "Build requirements" below)
 go install github.com/BackendStack21/odek/cmd/odek@latest
 
 # Use (set ODEK_API_KEY, DEEPSEEK_API_KEY, or OPENAI_API_KEY)
@@ -14,6 +14,8 @@ odek run "How many lines in go.mod?"
 # → 3 lines
 ```
 
+**Build requirements:** Go **1.25.12 or newer**. The `go` directive in `go.mod` pins this floor because earlier 1.25.x toolchains ship reachable standard-library CVEs; CI additionally runs `govulncheck` on every push/PR so new advisories fail the build.
+
 ---
 
 ## Why odek

docs/DEVELOPMENT.md

@@ -8,7 +8,7 @@ no maintained changelog file — create a release/tag and GitHub produces the no
 
 ## Prerequisites
 
-- Go 1.25+ (matches `go.mod`; CI builds with the same toolchain)
+- Go 1.25.12+ (matches `go.mod`; CI builds with the same toolchain line and runs `govulncheck` on every push/PR)
 - Docker (for sandbox integration tests only)
 
 ## Building

go.mod

@@ -1,12 +1,12 @@
 module github.com/BackendStack21/odek
 
-go 1.25.0
+go 1.25.12
 
 require (
 	github.com/BackendStack21/go-mcp v1.1.0
 	github.com/BackendStack21/go-vector v1.3.0
-	golang.org/x/net v0.54.0
-	golang.org/x/term v0.43.0
+	golang.org/x/net v0.57.0
+	golang.org/x/term v0.45.0
 )
 
-require golang.org/x/sys v0.44.0
+require golang.org/x/sys v0.47.0

go.sum

@@ -2,9 +2,9 @@ github.com/BackendStack21/go-mcp v1.1.0 h1:NQStOkqUWjzzzmySnfFHvPKhbKr92iBuPJjkN
 github.com/BackendStack21/go-mcp v1.1.0/go.mod h1:RKFw6nrl6ySQqqrR8KtG7HYZ/heyyjT8SjiEtlbTMY8=
 github.com/BackendStack21/go-vector v1.3.0 h1:VT1cwPAUzkg3Rt0fXA+jTzW472jgObqs85/TcPs4N7Q=
 github.com/BackendStack21/go-vector v1.3.0/go.mod h1:TkxZEqKGeN38QNWUoQt4xJcf6n2kI1pY7nu6ibXK1Yo=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=