Bump Go toolchain to 1.25.11 to resolve std-lib security vulnerabilities

Snyk flagged the Go standard library at 1.23.7 with 10 HIGH-severity vulns in std/crypto/x509, std/mime, std/net, std/net/http, and std/net/url. Bumping the go directive to 1.25.11 (the smallest patch that clears all reported HIGHs) builds against a patched std lib.

Also bump golangci-lint to v2.5.0 (built with go1.25) so the linter supports the new language version, and pin the lint workflow's Go to go.mod.

Co-Authored-By: shayan <shayan@cognition.ai>

Author: devin-ai-integration[bot]

.github/workflows/lint.yml

@@ -16,8 +16,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: stable
+          go-version-file: "go.mod"
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v8
         with:
-          version: v2.1
+          version: v2.5.0

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24.4-alpine AS build
+FROM golang:1.25.11-alpine AS build
 ARG VERSION="dev"
 
 # Set the working directory

go.mod

@@ -1,6 +1,6 @@
 module github.com/github/github-mcp-server
 
-go 1.23.7
+go 1.25.11
 
 require (
 	github.com/google/go-github/v72 v72.0.0