Bump Go toolchain to 1.25.12 to patch stdlib vulnerabilities

[devin-ai-integration]

Closes:

Summary

Snyk's 2026-08-10 audit reported 27 dependency vulnerabilities (11 high) in this repo; every one except a single medium came from the Go standard library pinned at go 1.23.7 in go.mod, not from third-party modules. Raising the declared Go version to 1.25.12 (the lowest release whose fixedIn clears all reported stdlib advisories, including std/crypto/x509 SNYK-GOLANG-STDCRYPTOX509-17135840 fixed in 1.25.11/1.26.4 and the 1.25.12/1.26.5 std/os symlink issue) is the whole fix.

Changes:

• go.mod: go 1.23.7 → go 1.25.12
• Dockerfile: builder golang:1.24.4-alpine → golang:1.25.12-alpine
• .github/workflows/lint.yml: three follow-on edits, each forced by the bump:
  • golangci-lint v2.1 → v2.4: v2.1 is built with Go 1.24 and refuses to load a config targeting Go 1.25 (the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.12)). v2.4.0 is the earliest v2 release built with Go 1.25.
  • go-version: stable → go-version-file: "go.mod": with stable the runner resolved Go 1.26.5, and golangci-lint v2.4.0 then panicked type-checking the 1.26 stdlib (file requires newer Go version go1.26 (application built with go1.25)). Reading the version from go.mod matches what every other workflow in the repo already does.
  • golangci/golangci-lint-action@v8 → pinned to 4afd733a84b1f43292c63897423277bb7f4313a9 (v8.0.0): touching this file put the line into SonarCloud's "new code" window, where its unpinned-action rule (githubactions:S7637) failed the security-rating quality gate.

No source changes were needed. go.yml, goreleaser.yml, license-check.yml, and docs-check.yml already use go-version-file: go.mod, so they pick up 1.25.12 automatically; code-scanning.yml resolves its Go version from the CodeQL environment.

Snyk before / after

snyk test --all-projects (125 dependencies tested):

	issues	vulnerable paths	high	medium	low
before	27	178	11	15	1
after	1	2	0	1	0

snyk code test reported zero issues before and after (unchanged, no source edits).

Not fixed (out of scope of this audit's finding list)

The one remaining issue is github.com/go-viper/mapstructure/v2@2.3.0 — SNYK-GOLANG-GITHUBCOMGOVIPERMAPSTRUCTUREV2-12177854, medium, "Improper Output Neutralization for Logs", fixed in 2.4.0. It is an indirect dependency pulled in by github.com/spf13/viper@1.20.1 and was not part of the stdlib findings this change targets, so it is left for a separate follow-up rather than widening this diff.

Verification

With Go 1.25.12 locally:

• go build ./... — passes
• go test ./... — all packages pass
• golangci-lint run (v2.4.0, repo .golangci.yml) — 0 issues

CI failures unrelated to this diff

• security/snyk (Cognition-default): fails with You have used your limit of private tests — an org test-quota limit, not a finding.
• Analyze (go) / Analyze (actions) (CodeQL): fail during codeql database init with permission_denied: read_package fetching the github/ccr-go-queries pack from GHCR — a registry-permission problem in the workflow's environment, independent of the Go version.

Link to Devin session: https://app.devin.ai/sessions/5849cf5bfb0847ad9ff24c48e8ca8a6d
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud