fix: replace bitwarden sdk with memory leak fix fork

[Skarlso]

Problem Statement

What is the problem you're trying to solve?

Related Issue

Fixes #...

Proposed Changes

How do you like to solve the issue and why?

Checklist

• I have read the contribution guidelines
• All commits are signed with git commit --signoff
• My changes have reasonable test coverage
• All tests pass with make test
• I ensured my PR is ready for review with make reviewable

Changes

This PR replaces the Bitwarden Go SDK dependency with a fork that includes a memory-leak fix.

Dependency Updates

• go.mod: Adds a replace directive to use github.com/Skarlso/sdk-go/v2 v2.0.0 instead of the official github.com/bitwarden/sdk-go, and updates the required version from v1.0.2 to v2.0.0.

Import Path Updates

• Updated import paths in four files to use the v2 API (github.com/bitwarden/sdk-go/v2):
  • pkg/bitwarden/bitwarden.go
  • pkg/bitwarden/bitwarden_test.go
  • pkg/server/server.go
  • pkg/server/server_test.go

No functional logic changes; all modifications are limited to dependency and import path updates.

[coderabbitai]

Walkthrough

Updated Bitwarden Go SDK dependency from v1 to v2 across the project. Modified go.mod to use v2.0.0 with a replace directive pointing to a fork, and updated all import paths in production and test files accordingly.

Changes

Cohort / File(s)	Summary
Module Configuration go.mod	Added replace directive for SDK v2 fork (github.com/Skarlso/sdk-go/v2) and updated required version from v1.0.2 to v2.0.0.
SDK Import Paths pkg/bitwarden/bitwarden.go, pkg/bitwarden/bitwarden_test.go, pkg/server/server.go, pkg/server/server_test.go	Updated import paths from github.com/bitwarden/sdk-go to github.com/bitwarden/sdk-go/v2 across application and test files.

🚥 Pre-merge checks | ✅ 1

✅ Passed checks (1 passed)

Check name	Status	Explanation
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into main

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

No actionable comments were generated in the recent review. 🎉

🧹 Recent nitpick comments

go.mod (1)

5-5: Supply chain concern: dependency on a personal fork for a security-sensitive SDK.

The fork (github.com/Skarlso/sdk-go/v2) and its v2.0.0 tag are verified to exist and signed. However, pointing a production dependency at a mutable tag introduces supply chain risks — the fork owner can force-push or delete the tag, and there's no upstream review gate. Consider:

1. Pinning to the specific commit hash (179b09a21e18fe176026118cfb55f04a4741304c) in the replace directive instead of the v2.0.0 tag for immutability.
2. Documenting (in the PR description or a code comment) what the memory-leak fix entails and whether an upstream PR has been opened to merge this back into github.com/bitwarden/sdk-go.
3. Adding a // TODO with a link to the upstream issue/PR so this replace directive can be removed once the fix lands upstream.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}