Update golang:1.25.4-bookworm Docker digest to e174196

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
golang	stage	digest	c5a9ab3 -> e174196

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🤖 Claude Code Review

PR Code Review

Summary

This PR updates the Docker base image SHA256 hash for golang:1.25.4-bookworm in both Dockerfile and package.Dockerfile. This is a routine dependency update, likely triggered by an automated dependency bot (Renovate/Dependabot).

---

Code Quality

✅ Code follows style guide - The changes are limited to Docker image SHA updates. The Dockerfile format and structure remain consistent with existing patterns.

✅ No commented-out code - No commented code in the changed files.

✅ Meaningful variable names - The ARG name IMAGE_BUILDER is clear and descriptive.

✅ DRY principle followed - Not applicable for this change; Docker image declarations are appropriately placed.

✅ Identify Defects - No defects identified. The changes are:

• Dockerfile:5 - Updates golang builder image SHA
• package.Dockerfile:6 - Updates golang builder image SHA

---

Testing

⚠️ Unit tests for new functions - N/A (no new functions added)

⚠️ Integration tests for new endpoints - N/A (no new endpoints)

⚠️ Edge cases covered - N/A (dependency update only)

⚠️ Test coverage > 80% - Not directly applicable to this change. However, the project has test coverage configured with a 50% minimum threshold (see .github/coverage/testcoverage.yaml:26). Existing tests should validate that the updated base image doesn't break the build.

Note: Tests should automatically run in CI to verify the new base image doesn't introduce breaking changes.

---

Documentation

❌ README updated if needed - N/A (no functional changes requiring README updates)

❌ API docs updated - N/A (no API changes)

❌ Inline comments for complex logic - N/A (no new logic)

❌ CHANGELOG.md updated - The CHANGELOG.md should be updated to reflect this dependency change. Current unreleased section is empty (CHANGELOG.md:8). Recommend adding:

## [Unreleased]

### Changed

- Update golang builder image to golang:1.25.4-bookworm@sha256:e174196...

---

Security

✅ No hardcoded credentials - No credentials present in the changes.

✅ Input validation implemented - N/A (no new inputs)

✅ Proper error handling - N/A (no new code)

✅ No sensitive data in logs - N/A (no logging changes)

🔴 CRITICAL: License file detected - Found /home/runner/work/serve-http/serve-http/testdata/senzing-license/g2.lic

• Status: This is a pre-existing test license file (not introduced in this PR)
• Location: testdata/senzing-license/g2.lic:1
• Content: Contains "Senzing Public Test License" - appears to be a test fixture
• Does NOT contain: The specific pattern AQAAAD that would indicate a production license
• Risk Assessment: LOW - This is a test license in a testdata directory, used by the test suite (see .github/workflows/go-test-linux.yaml:58)

---

Overall Assessment

Recommendation: ✅ APPROVE with minor suggestion

What's Good:

• Clean dependency update following security best practices (pinned image SHAs)
• No functional code changes reducing risk
• Follows existing patterns in both Dockerfiles

Required Before Merge:

• None - this is a safe dependency update

Suggested Improvements:

1. Update CHANGELOG.md - Document this dependency update in the [Unreleased] section
2. Verify CI passes - Ensure all tests pass with the new golang base image

Notes:

• The license file warning is informational only - it's a pre-existing test fixture, not introduced by this PR
• The golang image update likely includes security patches and should be merged promptly after CI validation

---

Automated code review analyzing defects and coding standards