[TT-16342] Update Gateway and Plugin Compiler to Go 1.25 (#7662)

## Description

This PR updates the Tyk Gateway and Plugin Compiler from Go 1.24 to Go
1.25.

The following files have been updated:
- `go.mod`: Updated Go version directive from `1.24.6` to `1.25`
- `.go-version`: Updated from `1.24` to `1.25`
- `Dockerfile`: Updated `GO_VERSION` ARG from `1.24` to `1.25`
- `.github/workflows/ci-tests.yml`: Updated matrix go-version from
`1.24.x` to `1.25.x`
- `.github/workflows/plugin-compiler-build.yml`: Updated `GOLANG_CROSS`
env from `1.24-bullseye` to `1.25-bullseye`
- `.github/workflows/release.yml`: Updated all golang-cross references
from `1.24-bullseye` to `1.25-bullseye` and `1.24-bookworm` to
`1.25-bookworm`
- `ci/images/plugin-compiler/Dockerfile`: Updated base image from
`golang-cross:1.24-bullseye` to `golang-cross:1.25-bullseye`

## Related Issue

https://tyktech.atlassian.net/browse/TT-16342

## Motivation and Context

This update is part of our commitment to staying current with Go
versions to minimize exposure to security vulnerabilities. The update
maintains all existing GODEBUG settings which remain valid in Go 1.25.

## How This Has Been Tested

- Verified `go mod tidy` runs successfully
- Built the main Tyk binary successfully with `go build -o tyk .`
- Confirmed the binary runs and reports correct version

## Types of changes

- [x] Refactoring or add test (improvements in base code or adds test
coverage to functionality)

## Checklist

- [x] I ensured that the documentation is up to date
- [x] I explained why this PR updates go.mod in detail with reasoning
why it's required
- [ ] I would like a code coverage CI quality gate exception and have
explained why





<!---TykTechnologies/jira-linter starts here-->

### Ticket Details

<details>
<summary>
<a href="https://tyktech.atlassian.net/browse/TT-16342" title="TT-16342"
target="_blank">TT-16342</a>
</summary>

|         |    |
|---------|----|
| Status  | In Dev |
| Summary | Update Gateway and Plugin Compiler to Go 1.25 |

Generated at: 2026-02-26 16:28:17

</details>

<!---TykTechnologies/jira-linter ends here-->

---------

Co-authored-by: Ilija Bojanovic <ilijabojanovic@gmail.com>

Author: edsonmichaque

.github/workflows/ci-tests.yml

@@ -95,7 +95,7 @@ jobs:
       fail-fast: false
       matrix:
         redis-version: [7]
-        go-version: [1.24.x]
+        go-version: [1.25.x]
 
     env:
       REDIS_IMAGE: redis:${{ matrix.redis-version }}

.github/workflows/plugin-compiler-build.yml

@@ -11,7 +11,7 @@ on:
       - "v*"
 
 env:
-  GOLANG_CROSS: 1.24-bullseye
+  GOLANG_CROSS: 1.25-bullseye
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/release.yml

@@ -41,9 +41,9 @@ jobs:
       fail-fast: false
       matrix:
         golang_cross:
-          - 1.24-bullseye
+          - 1.25-bullseye
         include:
-          - golang_cross: 1.24-bullseye
+          - golang_cross: 1.25-bullseye
             goreleaser: 'ci/goreleaser/goreleaser.yml'
             cgo: 1
             rpmvers: 'el/7 el/8 el/9 amazon/2 amazon/2023'
@@ -89,7 +89,7 @@ jobs:
           mask-aws-account-id: false
       - uses: aws-actions/amazon-ecr-login@v2
         id: ecr
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         with:
           mask-password: 'true'
       - uses: WarpBuilds/cache@v1
@@ -133,7 +133,7 @@ jobs:
           tykio/golang-cross:${{ matrix.golang_cross }} /tmp/build.sh
       - name: Docker metadata for ee CI
         id: ci_metadata_ee
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         uses: docker/metadata-action@v5
         with:
           images: |
@@ -148,7 +148,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}},prefix=v
             type=semver,pattern={{version}},prefix=v
       - name: push ee image to CI
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         uses: docker/build-push-action@v6
         with:
           context: "dist"
@@ -182,7 +182,7 @@ jobs:
             org.opencontainers.image.vendor=tyk.io
             org.opencontainers.image.version=${{ github.ref_name }}
       - name: push ee image to prod
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         uses: docker/build-push-action@v6
         with:
           context: "dist"
@@ -199,7 +199,7 @@ jobs:
             BUILD_PACKAGE_NAME=tyk-gateway-ee
       - name: Docker metadata for std CI
         id: ci_metadata_std
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         uses: docker/metadata-action@v5
         with:
           images: |
@@ -214,7 +214,7 @@ jobs:
             type=semver,pattern={{major}}.{{minor}},prefix=v
             type=semver,pattern={{version}},prefix=v
       - name: push std image to CI
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         uses: docker/build-push-action@v6
         with:
           context: "dist"
@@ -248,7 +248,7 @@ jobs:
             org.opencontainers.image.vendor=tyk.io
             org.opencontainers.image.version=${{ github.ref_name }}
       - name: push std image to prod
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         uses: docker/build-push-action@v6
         with:
           context: "dist"
@@ -265,7 +265,7 @@ jobs:
             BUILD_PACKAGE_NAME=tyk-gateway
       - name: save deb
         uses: actions/upload-artifact@v4
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         with:
           name: deb
           retention-days: 1
@@ -275,7 +275,7 @@ jobs:
             !dist/*fips*.deb
       - name: save rpm
         uses: actions/upload-artifact@v4
-        if: ${{ matrix.golang_cross == '1.24-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.25-bullseye' }}
         with:
           name: rpm
           retention-days: 1
@@ -605,7 +605,7 @@ jobs:
             -e GOMODCACHE=/go/pkg/mod \
             -v /tmp/build-dashboard.sh:/tmp/build-dashboard.sh \
             -w /go/src/github.com/TykTechnologies/tyk-analytics \
-            tykio/golang-cross:1.24-bookworm /tmp/build-dashboard.sh
+            tykio/golang-cross:1.25-bookworm /tmp/build-dashboard.sh
 
           echo "✅ Packages built successfully for $GOARCH"
       - name: Detect platform for Docker build

.go-version

@@ -1 +1 @@
-1.24
+1.25

Dockerfile

@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.24
+ARG GO_VERSION=1.25
 FROM golang:${GO_VERSION}-bullseye
 
 # Build essentials

ci/images/plugin-compiler/Dockerfile

@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=tykio/golang-cross:1.24-bullseye
+ARG BASE_IMAGE=tykio/golang-cross:1.25-bullseye
 FROM ${BASE_IMAGE}
 
 LABEL description="Image for plugin development"

gateway/cert_test.go

@@ -39,10 +39,15 @@ import (
 )
 
 const (
-	internalTLSErr          = "tls: unrecognized name"
-	badcertErr              = "tls: bad certificate"
-	certNotMatchErr         = "Client TLS certificate is required"
-	unknownCertAuthorityErr = "unknown certificate authority"
+	internalTLSErr  = "tls: unrecognized name"
+	certNotMatchErr = "Client TLS certificate is required"
+	// Go 1.25 TLS error strings for mutual TLS scenarios:
+	// When ClientCA is announced: no cert → handshake failure, wrong cert → unknown certificate authority
+	// When ClientCA is skipped:   no cert → bad certificate,   wrong cert → bad certificate
+	noCertAnnounceErr        = "tls: handshake failure"
+	wrongCertAnnounceErr     = "tls: unknown certificate authority"
+	noCertSkipAnnounceErr    = "tls: bad certificate"
+	wrongCertSkipAnnounceErr = "tls: bad certificate"
 )
 
 func TestGatewayTLS(t *testing.T) {
@@ -207,7 +212,7 @@ func TestGatewayControlAPIMutualTLS(t *testing.T) {
 			// Should raise error for ControlAPI without certificate
 			{ControlRequest: true, ErrorMatch: unknownErr},
 			// Should raise error for unknown certificate
-			{ControlRequest: true, ErrorMatch: unknownCertAuthorityErr, Client: clientWithCert},
+			{ControlRequest: true, ErrorMatch: wrongCertAnnounceErr, Client: clientWithCert},
 		}...)
 	})
 
@@ -259,7 +264,7 @@ func TestGatewayControlAPIMutualTLS(t *testing.T) {
 
 		// Should fail as no valid cert IDs exist in Certificates.ControlAPI
 		_, _ = ts.Run(t, test.TestCase{
-			Path: "/tyk/certs", Code: http.StatusForbidden, ErrorMatch: unknownCertAuthorityErr, ControlRequest: true, AdminAuth: true, Client: clientWithCert,
+			Path: "/tyk/certs", Code: http.StatusForbidden, ErrorMatch: wrongCertAnnounceErr, ControlRequest: true, AdminAuth: true, Client: clientWithCert,
 		})
 	})
 
@@ -378,9 +383,11 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 	serverCertPem, _, combinedPEM, _ := crypto.GenServerCertificate()
 	certID, _, _ := certs.GetCertIDAndChainPEM(combinedPEM, "")
 
-	expectedCertErr := unknownCertAuthorityErr
+	expectedNoCertErr := noCertAnnounceErr
+	expectedWrongCertErr := wrongCertAnnounceErr
 	if skipCAAnnounce {
-		expectedCertErr = badcertErr
+		expectedNoCertErr = noCertSkipAnnounceErr
+		expectedWrongCertErr = wrongCertSkipAnnounceErr
 	}
 
 	conf := func(globalConf *config.Config) {
@@ -465,7 +472,7 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 			})
 
 			_, _ = ts.Run(t, test.TestCase{
-				ErrorMatch: badcertErr,
+				ErrorMatch: expectedNoCertErr,
 				Client:     client,
 				Domain:     "localhost",
 			})
@@ -492,7 +499,7 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 
 			client = GetTLSClient(&clientCert, serverCertPem)
 			_, _ = ts.Run(t, test.TestCase{
-				Client: client, Domain: "localhost", ErrorMatch: expectedCertErr,
+				Client: client, Domain: "localhost", ErrorMatch: expectedWrongCertErr,
 			})
 		})
 
@@ -511,7 +518,7 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 			})
 
 			_, _ = ts.Run(t, test.TestCase{
-				Client: client, ErrorMatch: expectedCertErr, Domain: "localhost",
+				Client: client, ErrorMatch: expectedWrongCertErr, Domain: "localhost",
 			})
 		})
 	})
@@ -633,13 +640,13 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 						Path:       "/with_mutual",
 						Client:     clientWithoutCert,
 						Domain:     domain,
-						ErrorMatch: badcertErr,
+						ErrorMatch: expectedNoCertErr,
 					},
 					{
 						Path:       "/with_mutual_2",
 						Client:     clientWithoutCert,
 						Domain:     domain,
-						ErrorMatch: badcertErr,
+						ErrorMatch: expectedNoCertErr,
 					},
 				}...)
 			})
@@ -653,14 +660,14 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 					Path:       "/with_mutual",
 					Client:     client,
 					Domain:     domain,
-					ErrorMatch: expectedCertErr,
+					ErrorMatch: expectedWrongCertErr,
 				})
 
 				_, _ = ts.Run(t, test.TestCase{
 					Path:       "/with_mutual_2",
 					Client:     client,
 					Domain:     domain,
-					ErrorMatch: expectedCertErr,
+					ErrorMatch: expectedWrongCertErr,
 				})
 			})
 
@@ -749,7 +756,7 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 						Path:       "/with_mutual",
 						Client:     clientWithoutCert,
 						Domain:     domain,
-						ErrorMatch: badcertErr,
+						ErrorMatch: expectedNoCertErr,
 					})
 				}
 
@@ -779,7 +786,7 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 						Path:       "/with_mutual",
 						Client:     client,
 						Domain:     domain,
-						ErrorMatch: expectedCertErr,
+						ErrorMatch: expectedWrongCertErr,
 					})
 				}
 			})
@@ -842,7 +849,7 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 					_, _ = ts.Run(t, test.TestCase{
 						Path:       "/with_mutual",
 						Client:     clientWithoutCert,
-						ErrorMatch: badcertErr,
+						ErrorMatch: expectedNoCertErr,
 					})
 				}
 
@@ -871,7 +878,7 @@ func testAPIMutualTLSHelper(t *testing.T, skipCAAnnounce bool) {
 					_, _ = ts.Run(t, test.TestCase{
 						Path:       "/with_mutual",
 						Client:     client,
-						ErrorMatch: expectedCertErr,
+						ErrorMatch: expectedWrongCertErr,
 					})
 				}
 			})
@@ -1886,7 +1893,7 @@ func TestCipherSuites(t *testing.T) {
 			MaxVersion:         tls.VersionTLS12,
 		}}}
 
-		_, _ = ts.Run(t, test.TestCase{Client: client, Path: "/", ErrorMatch: "tls: handshake failure"})
+		_, _ = ts.Run(t, test.TestCase{Client: client, Path: "/", ErrorMatch: noCertAnnounceErr})
 	})
 }
 
@@ -2004,7 +2011,7 @@ func TestClientCertificates_WithProtocolTLS(t *testing.T) {
 	// client
 	t.Run("bad certificate", func(t *testing.T) {
 		_, err := tls.Dial("tcp", apiAddr, mTLSConfig)
-		assert.ErrorContains(t, err, badcertErr)
+		assert.ErrorContains(t, err, noCertAnnounceErr)
 	})
 
 	t.Run("correct certificate", func(t *testing.T) {

go.mod

@@ -1,6 +1,6 @@
 module github.com/TykTechnologies/tyk
 
-go 1.24.6
+go 1.25
 
 godebug (
 	tls10server=1