[IMPROVED] Bump dependencies and go version

[piotrpio]

Signed-off-by: Piotr Piotrowski piotr@synadia.com

[synadia-claude-reviewer]

Claude finished @piotrpio's task in 1m 31s —— View job

---

PR Review

• Gather context
• Review dependency changes in go.mod / go_test.mod
• Check for security or compatibility issues
• Post review summary

---

This is a routine dependency bump with no correctness, security, or compatibility issues found.

Summary of changes:

Dependency	Before	After
Go minimum version	1.24.0	1.25.0
klauspost/compress	v1.18.2	v1.18.5
nats-io/nkeys	v0.4.12	v0.4.15
golang.org/x/crypto	v0.46.0	v0.49.0
golang.org/x/sys	v0.39.0	v0.42.0
nats-server/v2 (test)	v2.12.3	v2.12.6
golang/protobuf (test)	v1.4.2	v1.5.4
google.golang.org/protobuf (test)	v1.23.0	v1.33.0
nats-io/jwt/v2 (test)	v2.8.0	v2.8.1

Observations:

• The Go minimum version bump to 1.25.0 is consistent with the CI matrix, which already targets Go 1.25 and 1.26. This intentionally drops Go 1.24 support.
• golang.org/x/crypto and golang.org/x/sys bumps are aligned — these track together as standard and are important for picking up security patches.
• google.golang.org/protobuf jumps from v1.23.0 → v1.33.0 (10 minor versions). This is a test-only dependency, and the old v1.23.0 entries are correctly retained in go_test.sum alongside the new ones (standard go.sum accumulation behavior).
• All checksums in go.sum and go_test.sum are updated consistently.

No issues to flag. LGTM.

[coveralls]

coverage: 85.445% (+0.006%) from 85.439%
when pulling 1f88213 on bump-dependencies
into b7908ea on main.

[Jarema]

LGTM!