feat(core)!: migrate to Fiber v3, cut /v2 major

[rodrigodh]

What

Migrates lib-observability from Fiber v2 to Fiber v3.4.0 and cuts the /v2 module major. First step of the coordinated org-wide Fiber v2→v3 migration (this library is the topological root — lib-commons and everything downstream depend on it).

Changes

• Module path → github.com/LerianStudio/lib-observability/v2
• gofiber/fiber v2.52.13 → v3.4.0 (v2 dropped from go.mod)
• *fiber.Ctx → fiber.Ctx (v3 interface, by value) across all exported HTTP helpers in middleware/ and tracing/
• c.UserContext()/SetUserContext() → c.Context()/SetContext(); app.Add now takes []string
• No behavior change intended — mechanical framework migration

Validation

go build ./..., full go test -tags=unit ./... (843 tests), go vet, gofmt, goimports, golangci-lint all green.

Coordinated-wave context

This is the only independently-mergeable PR in the wave (no cross-lib dependencies). Merge + publish order for the rest: lib-observability → lib-commons → {lib-auth, lib-license-go, lib-systemplane} → plugin-access-manager. Once this merges and tags v2.0.0, the downstream libs bump to the real v2.0.0 and stack their PRs.

Breaking-change inventory + playbook: see internal-docs infra-layer/fiber-v3-migration (PRs #230, #231).

BREAKING CHANGE: consumers must move to /v2 and Fiber v3.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ee6d2f87-aee2-44f2-85e1-253e6aa5b880

📥 Commits

Reviewing files that changed from the base of the PR and between f38d000 and ddb09cc.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (42)

• .trivyignore
• assert/assert.go
• assert/assert_extended_test.go
• assert/assert_test.go
• context_tracking_test.go
• go.mod
• log/go_logger.go
• metrics/metrics.go
• metrics/metrics_test.go
• middleware/context_span.go
• middleware/context_span_test.go
• middleware/helpers.go
• middleware/helpers_test.go
• middleware/logging.go
• middleware/logging_obfuscation.go
• middleware/logging_test.go
• middleware/metrics.go
• middleware/request_attrs.go
• middleware/telemetry.go
• middleware/telemetry_metrics_test.go
• middleware/telemetry_route_test.go
• middleware/telemetry_test.go
• middleware/tenant.go
• middleware/tenant_test.go
• observability.go
• runtime/goroutine.go
• runtime/helpers_test.go
• runtime/log_mode_link_test.go
• runtime/metrics.go
• runtime/metrics_test.go
• runtime/recover.go
• runtime/tracing.go
• system.go
• system_test.go
• tracing/obfuscation.go
• tracing/obfuscation_test.go
• tracing/otel.go
• tracing/otel_test.go
• tracing/processor.go
• tracing/v2_test.go
• zap/zap.go
• zap/zap_test.go

---

📝 Walkthrough

Walkthrough

The repository module path moved to /v2, Fiber upgraded to v3, and observability imports and Fiber context handling were updated across production code and tests. Dependency metadata and a Trivy ignore entry were also refreshed.

Changes

v2 Module and Fiber v3 Migration

Layer / File(s)	Summary
Module identity and shared package imports .trivyignore, go.mod, assert/*, log/*, metrics/*, runtime/*, system*, tracing/*, zap/*, observability.go, context_tracking_test.go	The module and internal imports now use /v2; Fiber v3 and refreshed indirect dependencies are declared, and the specified Trivy vulnerability is ignored until 2026-07-30.
Middleware context and handler API migration middleware/context_span*, middleware/helpers*, middleware/logging*, middleware/metrics.go, middleware/request_attrs.go, middleware/tenant*	Middleware handlers and helpers use fiber.Ctx values, while HTTP logging and request data use Fiber v3 context accessors.
Telemetry and tracing context propagation middleware/telemetry*, tracing/otel*	Telemetry and tracing propagation, span completion, metric recording, tenant attributes, and related tests were migrated to Fiber v3 context APIs.

Possibly related issues

• LerianStudio/flowker#55: Covers migration to the standalone observability module, including logging, tracing, metrics, and related imports.

Possibly related PRs

• LerianStudio/lib-observability#28: Updates the same .trivyignore suppression for GO-2026-5932.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feat/fiber-v3

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🔒 Security Scan Results — lib-observability

✅ PR Mergeable — no blocking findings

Stage	Status	Blocking?
Filesystem Scan	✅ Clean	—
Docker Image Scan	➖ Skipped	—
Docker Hub Health Score	➖ Skipped	—
Pre-release Version Check	✅ Clean	—

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

---

Pre-release Version Check

✅ No unstable version pins found.

---

_{🔍 View full scan logs}

[lerian-studio]

📊 Unit Test Coverage Report: lib-observability

Metric	Value
Overall Coverage	85.7% ✅ PASS
Threshold	80%

Coverage by Package

Package	Coverage
github.com/LerianStudio/lib-observability/v2/assert	97.9%
github.com/LerianStudio/lib-observability/v2/constants	83.3%
github.com/LerianStudio/lib-observability/v2/log	94.9%
github.com/LerianStudio/lib-observability/v2/metrics	91.4%
github.com/LerianStudio/lib-observability/v2/middleware	76.9%
github.com/LerianStudio/lib-observability/v2/redaction	95.8%
github.com/LerianStudio/lib-observability/v2/runtime	80.4%
github.com/LerianStudio/lib-observability/v2/tracing	84.8%
github.com/LerianStudio/lib-observability/v2/zap	96.0%
github.com/LerianStudio/lib-observability/v2	91.5%

---

Generated by Go PR Analysis workflow

[coderabbitai]

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

putComment timed out