Bump Go to 1.25.13 to clear 13 HIGH stdlib CVEs

[devin-ai-integration]

Closes:

All HIGH Snyk findings in this repo were Go standard-library CVEs attributed to the go 1.23.7 directive. Bumping the go directive to 1.25.13 (the latest 1.25 patch, a fixed release for every one of them) and the Docker build stage from golang:1.24.4-alpine to golang:1.26.6-alpine clears them all.

The toolchain bump forced two follow-on changes, both required to keep CI green:

• golangci-lint pin v2.1 → v2.12.2: v2.1 is built with Go 1.24 and refuses to run against a go.mod targeting 1.25 (the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.13)). Every release built with Go ≤ 1.25 also panics when analyzing packages compiled by Go 1.26 (which go-version: stable installs), so v2.12.2 (built with go1.26.2) is the first workable pin.
• 9 findings from the newer linters, fixed minimally and with no behavior change: reflect.Ptr → reflect.Pointer (govet inline), WriteString(fmt.Sprintf(...)) → fmt.Fprintf(...) (staticcheck QF1012, 3x), and #nosec annotations for gosec's new G703 (doc generator writing to a path from a CLI flag — same lines already carry #nosec G304/G306) and G117 (json.Marshal of secret-scanning alerts, which is exactly what those tools exist to return).

Snyk IDs fixed (13 unique HIGH)

Snyk ID	Package	Fixed in
SNYK-GOLANG-STDCRYPTOX509-14545542	std/crypto/x509	1.24.8 / 1.25.2
SNYK-GOLANG-STDCRYPTOX509-14545554	std/crypto/x509	1.24.9 / 1.25.3
SNYK-GOLANG-STDCRYPTOX509-15928851	std/crypto/x509	1.25.9
SNYK-GOLANG-STDCRYPTOX509-17135840	std/crypto/x509	1.25.11
SNYK-GOLANG-STDMIME-17135844	std/mime	1.25.11
SNYK-GOLANG-STDNET-16535159	std/net	1.25.10
SNYK-GOLANG-STDNET-16535161	std/net	1.25.10
SNYK-GOLANG-STDNETHTTP-14548596	std/net/http	1.23.10 / 1.24.4
SNYK-GOLANG-STDNETHTTP-16535158	std/net/http	1.25.10
SNYK-GOLANG-STDNETHTTP-18858429	std/net/http	1.25.13
SNYK-GOLANG-STDNETURL-15139468	std/net/url	1.24.12 / 1.25.6
SNYK-GOLANG-STDNETURL-18858438	std/net/url	1.25.13
SNYK-GOLANG-STDOS-17905377	std/os	1.25.12

Before / after (snyk test --all-projects, Snyk CLI 1.1306.4)

Severity	Before	After
critical	0	0
high	92 (13 unique)	0
medium	107	2
low	3	0

Intentionally left unfixed

• SNYK-GOLANG-GITHUBCOMGOVIPERMAPSTRUCTUREV2-12177854 (medium, go-viper/mapstructure/v2 2.3.0 → 2.4.0, transitive via spf13/viper) — medium severity, out of scope for this pass.
• Chose go 1.25.13 rather than 1.26.x for the go directive to avoid forcing consumers onto the newest major line; every HIGH finding has a 1.25.x fixed release. The Docker builder image uses 1.26.6 (latest stable), which satisfies the directive.

Verification

On go1.26.6: go build ./..., go test ./..., golangci-lint v2.12.2 run (0 issues), and generate-docs produces no diff. A fresh snyk test reports zero high/critical findings.

Link to Devin session: https://app.devin.ai/sessions/862ec2de1ef042cd8147bf73f4a0b348
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)
B Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE