Bump Go to 1.25.14 to clear stdlib high-severity advisories

[devin-ai-integration]

Closes:

Summary

Snyk flagged 13 unique high-severity findings, all attributed to the Go standard library pinned by go.mod at 1.23.7 (std/net/http, std/net/url, std/os, std/net, std/crypto/x509, std/mime). No application code changes — version bumps only.

• go.mod: go 1.23.7 → go 1.25.14 (latest 1.25 patch; >= 1.25.13 clears all listed advisories). Staying on the 1.24 line would leave several of them open, so 1.25.14 was chosen.
• Dockerfile: builder image golang:1.24.4-alpine → golang:1.25.14-alpine
• .github/workflows/lint.yml: golangci-lint v2.1 → v2.5 and the lint job's Go now comes from go-version-file: "go.mod" instead of stable. Both are required by the bump: golangci-lint v2.1 is built with Go 1.24 and refuses a 1.25 target outright, and v2.5 (built with Go 1.25) panics while type-checking against the stable (1.27) toolchain's stdlib. The action is also pinned to its v8 commit SHA to satisfy the Sonar quality gate, which counts the touched line as new code.

No other workflow needed changes — they all already resolve Go from go.mod.

Verification

• go build ./..., go test ./..., golangci-lint run (v2.5.0 on Go 1.25.14) — all clean locally
• docker build . — succeeds on the new builder image
• snyk test --all-projects --severity-threshold=high — "Tested 125 dependencies for known issues, no vulnerable paths found."
• CI: build (ubuntu/macos/windows), lint, license-check, docs-check, Snyk and Sonar all green. The CodeQL Analyze (go) / Analyze (actions) failures are a pre-existing org configuration problem unrelated to this change (Error getting package versions 'github/ccr-go-queries' ... 403 permission_denied), and reproduce on other branches. The Docker workflow job sits queued with no runner, as on other recent branches.

Link to Devin session: https://app.devin.ai/sessions/3b098a7759be4081a54f2b5f5196371c
Requested by: @shayanshafii

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud