chore: updates to Go 1.25 and refactors some code

api/v1alpha1/ai_gateway_route_helper.go

@@ -20,7 +20,7 @@ const (
 	inferencePoolKind = "InferencePool"
 )
 
-// GetTimeoutsWithDefaults returns the timeouts with default values applied when not specified.
+// GetTimeoutsOrDefault returns the timeouts with default values applied when not specified.
 // This ensures that AI Gateway routes have appropriate timeout defaults for AI workloads.
 func (r *AIGatewayRouteRule) GetTimeoutsOrDefault() *gwapiv1.HTTPRouteTimeouts {
 	defaultTimeout := defaultRequestTimeout

cmd/aigw/docker-compose-otel.yaml

@@ -10,7 +10,7 @@ volumes:
 services:
   # aigw-build builds the Envoy AI Gateway CLI binary, so you can use main code.
   aigw-build:
-    image: golang:1.24.6
+    image: golang:1.25
     container_name: aigw-build
     working_dir: /workspace
     volumes:

cmd/aigw/docker-compose.yaml

@@ -11,7 +11,7 @@ volumes:
 services:
   # aigw-build builds the Envoy AI Gateway CLI binary, so you can use main code.
   aigw-build:
-    image: golang:1.24.6
+    image: golang:1.25
     container_name: aigw-build
     working_dir: /workspace
     volumes:
@@ -56,7 +56,7 @@ services:
 
   # chat-completion is a simple curl-based test client for sending requests to aigw.
   chat-completion:
-    image: golang:1.24.6
+    image: golang:1.25
     container_name: chat-completion
     profiles: ["test"]
     env_file:

cmd/aigw/run.go

@@ -320,7 +320,7 @@ func (runCtx *runCmdContext) mustClearSetOwnerReferencesAndStatusAndWriteObj(typ
 	if err != nil {
 		panic(err)
 	}
-	var raw map[string]interface{}
+	var raw map[string]any
 	err = yaml.Unmarshal(marshaled, &raw)
 	if err != nil {
 		panic(err)

cmd/extproc/mainlib/main.go

@@ -218,8 +218,8 @@ func listen(ctx context.Context, name, network, address string) (net.Listener, e
 
 // listenAddress returns the network and address for the given address flag.
 func listenAddress(addrFlag string) (string, string) {
-	if strings.HasPrefix(addrFlag, "unix://") {
-		p := strings.TrimPrefix(addrFlag, "unix://")
+	if after, ok := strings.CutPrefix(addrFlag, "unix://"); ok {
+		p := after
 		_ = os.Remove(p) // Remove the socket file if it exists.
 		return "unix", p
 	}

go.mod

@@ -1,6 +1,6 @@
 module github.com/envoyproxy/ai-gateway
 
-go 1.24.6
+go 1.25
 
 replace go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
 

internal/apischema/anthropic/anthropic.go

@@ -8,9 +8,10 @@ package anthropic
 
 // MessagesRequest represents a request to the Anthropic Messages API.
 // Uses a dictionary approach to handle any JSON structure flexibly.
-type MessagesRequest map[string]interface{}
+type MessagesRequest map[string]any
 
 // Helper methods to extract common fields from the dictionary
+
 func (m MessagesRequest) GetModel() string {
 	if model, ok := m["model"].(string); ok {
 		return model

internal/apischema/awsbedrock/awsbedrock.go

@@ -287,7 +287,7 @@ type ToolUseBlock struct {
 	// Name is the name the tool that the model wants to use.
 	Name string `json:"name"`
 	// Input is to pass to the tool in JSON format.
-	Input map[string]interface{} `json:"input"`
+	Input map[string]any `json:"input"`
 	// ToolUseID is the ID for the tool request, pattern is ^[a-zA-Z0-9_-]+$.
 	ToolUseID string `json:"toolUseId"`
 }

internal/apischema/openai/openai.go

@@ -139,7 +139,7 @@ type ChatCompletionContentPartUserUnionParam struct {
 }
 
 func (c *ChatCompletionContentPartUserUnionParam) UnmarshalJSON(data []byte) error {
-	var chatContentPart map[string]interface{}
+	var chatContentPart map[string]any
 	if err := json.Unmarshal(data, &chatContentPart); err != nil {
 		return err
 	}
@@ -187,7 +187,7 @@ func (c ChatCompletionContentPartUserUnionParam) MarshalJSON() ([]byte, error) {
 }
 
 type StringOrAssistantRoleContentUnion struct {
-	Value interface{}
+	Value any
 }
 
 func (s *StringOrAssistantRoleContentUnion) UnmarshalJSON(data []byte) error {
@@ -213,7 +213,7 @@ func (s StringOrAssistantRoleContentUnion) MarshalJSON() ([]byte, error) {
 }
 
 type StringOrArray struct {
-	Value interface{}
+	Value any
 }
 
 func (s *StringOrArray) UnmarshalJSON(data []byte) error {
@@ -256,7 +256,7 @@ func (s StringOrArray) MarshalJSON() ([]byte, error) {
 }
 
 type StringOrUserRoleContentUnion struct {
-	Value interface{}
+	Value any
 }
 
 func (s *StringOrUserRoleContentUnion) UnmarshalJSON(data []byte) error {
@@ -282,12 +282,12 @@ func (s StringOrUserRoleContentUnion) MarshalJSON() ([]byte, error) {
 }
 
 type ChatCompletionMessageParamUnion struct {
-	Value interface{}
+	Value any
 	Type  string
 }
 
 func (c *ChatCompletionMessageParamUnion) UnmarshalJSON(data []byte) error {
-	var chatMessage map[string]interface{}
+	var chatMessage map[string]any
 	if err := json.Unmarshal(data, &chatMessage); err != nil {
 		return err
 	}
@@ -502,7 +502,6 @@ type Reasoning struct {
 	Summary *string `json:"summary,omitempty"`
 }
 
-// ChatCompletionRequest represents a request structure for chat completion API.
 // ChatCompletionModality represents the output types that the model can generate.
 type ChatCompletionModality string
 
@@ -704,7 +703,7 @@ type ChatCompletionRequest struct {
 	// Stop string / array / null Defaults to null
 	// Up to 4 sequences where the API will stop generating further tokens.
 	// Docs: https://platform.openai.com/docs/api-reference/chat/create#chat-create-stop
-	Stop interface{} `json:"stop,omitempty"`
+	Stop any `json:"stop,omitempty"`
 
 	// Stream: If set, partial message deltas will be sent, like in ChatGPT.
 	// Docs: https://platform.openai.com/docs/api-reference/chat/create#chat-create-stream
@@ -810,7 +809,7 @@ const (
 
 // ChatCompletionToolChoice represents the tool choice for chat completions.
 // It can be either a string (none, auto, required) or a ChatCompletionNamedToolChoice object.
-type ChatCompletionToolChoice interface{}
+type ChatCompletionToolChoice any
 
 // ChatCompletionNamedToolChoice specifies a tool the model should use. Use to force the model to call a specific function.
 type ChatCompletionNamedToolChoice struct {
@@ -1236,7 +1235,7 @@ type Embedding struct {
 
 // EmbeddingUnion is a union type that can handle both []float64 and string formats.
 type EmbeddingUnion struct {
-	Value interface{}
+	Value any
 }
 
 // UnmarshalJSON implements json.Unmarshaler to handle both []float64 and string formats.

internal/apischema/openai/openai_test.go

@@ -275,13 +275,13 @@ func TestOpenAIChatCompletionMessageUnmarshal(t *testing.T) {
 					JSONSchema: &ChatCompletionResponseFormatJSONSchema{
 						Name:   "math_response",
 						Strict: true,
-						Schema: map[string]interface{}{
+						Schema: map[string]any{
 							"additionalProperties": false,
 							"type":                 "object",
-							"properties": map[string]interface{}{
+							"properties": map[string]any{
 								"step": "test_step",
 							},
-							"required": []interface{}{"steps"},
+							"required": []any{"steps"},
 						},
 					},
 				},
@@ -310,7 +310,7 @@ func TestOpenAIChatCompletionMessageUnmarshal(t *testing.T) {
 				},
 				MaxCompletionTokens: ptr.To[int64](1024),
 				ParallelToolCalls:   ptr.To(true),
-				Stop:                []interface{}{"\n", "stop"},
+				Stop:                []any{"\n", "stop"},
 				ServiceTier:         ptr.To("flex"),
 			},
 		},
@@ -1232,7 +1232,7 @@ func TestEmbeddingUnionUnmarshal(t *testing.T) {
 	tests := []struct {
 		name    string
 		input   string
-		want    interface{}
+		want    any
 		wantErr bool
 	}{
 		{

internal/controller/ai_service_backend_test.go

@@ -98,7 +98,7 @@ func TestAIServiceBackendController_Reconcile_error_with_multiple_bsps(t *testin
 
 	const backendName, namespace = "mybackend", "default"
 	// Create Multiple Backend Security Policies that target the same backend.
-	for i := 0; i < 5; i++ {
+	for i := range 5 {
 		bsp := &aigv1a1.BackendSecurityPolicy{
 			ObjectMeta: metav1.ObjectMeta{Name: fmt.Sprintf("bsp-%d", i), Namespace: namespace},
 			Spec: aigv1a1.BackendSecurityPolicySpec{

internal/controller/backend_security_policy_test.go

@@ -255,8 +255,8 @@ func TestBackendSecurityPolicyController_RotateCredential(t *testing.T) {
 	ctx := oidcv3.InsecureIssuerURLContext(t.Context(), discoveryServer.URL)
 
 	data := map[string][]byte{
-		"credentials": []byte(fmt.Sprintf("[%s]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\nregion = %s\n",
-			"default", "accessKey", "secretKey", "sessionToken", "us-east-2")),
+		"credentials": fmt.Appendf(nil, "[%s]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\nregion = %s\n",
+			"default", "accessKey", "secretKey", "sessionToken", "us-east-2"),
 	}
 	secret := &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{
@@ -707,8 +707,8 @@ func TestBackendSecurityPolicyController_ExecutionRotation(t *testing.T) {
 	require.NoError(t, cl.Create(t.Context(), bsp))
 	ctx := oidcv3.InsecureIssuerURLContext(t.Context(), discoveryServer.URL)
 	data := map[string][]byte{
-		"credentials": []byte(fmt.Sprintf("[%s]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\nregion = %s\n",
-			"default", "accessKey", "secretKey", "sessionToken", "us-east-2")),
+		"credentials": fmt.Appendf(nil, "[%s]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\nregion = %s\n",
+			"default", "accessKey", "secretKey", "sessionToken", "us-east-2"),
 	}
 	now := time.Now()
 	expirationTime := now.Add(-1 * time.Hour)

internal/controller/gateway.go

@@ -441,9 +441,9 @@ func (c *GatewayController) annotateGatewayPods(ctx context.Context,
 
 		c.logger.Info("annotating pod", "namespace", pod.Namespace, "name", pod.Name)
 		_, err := c.kube.CoreV1().Pods(pod.Namespace).Patch(ctx, pod.Name, types.MergePatchType,
-			[]byte(fmt.Sprintf(
+			fmt.Appendf(nil,
 				`{"metadata":{"annotations":{"%s":"%s"}}}`, aigatewayUUIDAnnotationKey, uuid),
-			), metav1.PatchOptions{})
+			metav1.PatchOptions{})
 		if err != nil {
 			return fmt.Errorf("failed to patch pod %s: %w", pod.Name, err)
 		}
@@ -453,9 +453,9 @@ func (c *GatewayController) annotateGatewayPods(ctx context.Context,
 		for _, dep := range deployments {
 			c.logger.Info("rolling out deployment", "namespace", dep.Namespace, "name", dep.Name)
 			_, err := c.kube.AppsV1().Deployments(dep.Namespace).Patch(ctx, dep.Name, types.MergePatchType,
-				[]byte(fmt.Sprintf(
+				fmt.Appendf(nil,
 					`{"spec":{"template":{"metadata":{"annotations":{"%s":"%s"}}}}}`, aigatewayUUIDAnnotationKey, uuid),
-				), metav1.PatchOptions{})
+				metav1.PatchOptions{})
 			if err != nil {
 				return fmt.Errorf("failed to patch deployment %s: %w", dep.Name, err)
 			}
@@ -464,9 +464,9 @@ func (c *GatewayController) annotateGatewayPods(ctx context.Context,
 		for _, daemonSet := range daemonSets {
 			c.logger.Info("rolling out daemonSet", "namespace", daemonSet.Namespace, "name", daemonSet.Name)
 			_, err := c.kube.AppsV1().DaemonSets(daemonSet.Namespace).Patch(ctx, daemonSet.Name, types.MergePatchType,
-				[]byte(fmt.Sprintf(
+				fmt.Appendf(nil,
 					`{"spec":{"template":{"metadata":{"annotations":{"%s":"%s"}}}}}`, aigatewayUUIDAnnotationKey, uuid),
-				), metav1.PatchOptions{})
+				metav1.PatchOptions{})
 			if err != nil {
 				return fmt.Errorf("failed to patch daemonset %s: %w", daemonSet.Name, err)
 			}

internal/controller/rotators/aws_oidc_rotator_test.go

@@ -55,8 +55,8 @@ func createTestAwsSecret(t *testing.T, client client.Client, bspName string, acc
 		profile = awsProfileName
 	}
 	data := map[string][]byte{
-		AwsCredentialsKey: []byte(fmt.Sprintf("[%s]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\nregion = %s\n",
-			profile, accessKey, secretKey, sessionToken, awsRegion)),
+		AwsCredentialsKey: fmt.Appendf(nil, "[%s]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\nregion = %s\n",
+			profile, accessKey, secretKey, sessionToken, awsRegion),
 	}
 	err := client.Create(t.Context(), &corev1.Secret{
 		ObjectMeta: metav1.ObjectMeta{

internal/controller/secret_test.go

@@ -6,7 +6,8 @@
 package controller
 
 import (
-	"sort"
+	"cmp"
+	"slices"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -62,11 +63,11 @@ func TestSecretController_Reconcile(t *testing.T) {
 	}})
 	require.NoError(t, err)
 	actual := eventCh.RequireItemsEventually(t, len(originals))
-	sort.Slice(actual, func(i, j int) bool {
-		return actual[i].Name < actual[j].Name
+	slices.SortFunc(actual, func(a, b *aigv1a1.BackendSecurityPolicy) int {
+		return cmp.Compare(a.Name, b.Name)
 	})
-	sort.Slice(originals, func(i, j int) bool {
-		return originals[i].Name < originals[j].Name
+	slices.SortFunc(originals, func(a, b *aigv1a1.BackendSecurityPolicy) int {
+		return cmp.Compare(a.Name, b.Name)
 	})
 	require.Equal(t, originals, actual)
 

internal/extensionserver/extensionserver_test.go

@@ -184,19 +184,19 @@ func Test_maybeModifyCluster(t *testing.T) {
 // Helper function to create an InferencePool ExtensionResource.
 func createInferencePoolExtensionResource(name, namespace string) *egextension.ExtensionResource {
 	unstructuredObj := &unstructured.Unstructured{
-		Object: map[string]interface{}{
+		Object: map[string]any{
 			"apiVersion": "inference.networking.x-k8s.io/v1alpha2",
 			"kind":       "InferencePool",
-			"metadata": map[string]interface{}{
+			"metadata": map[string]any{
 				"name":      name,
 				"namespace": namespace,
 			},
-			"spec": map[string]interface{}{
+			"spec": map[string]any{
 				"targetPortNumber": int32(8080),
-				"selector": map[string]interface{}{
+				"selector": map[string]any{
 					"app": "test-inference",
 				},
-				"extensionRef": map[string]interface{}{
+				"extensionRef": map[string]any{
 					"name": "test-epp",
 				},
 			},
@@ -1187,10 +1187,10 @@ func TestConstructInferencePoolsFrom(t *testing.T) {
 
 	t.Run("wrong API version", func(t *testing.T) {
 		unstructuredObj := &unstructured.Unstructured{
-			Object: map[string]interface{}{
+			Object: map[string]any{
 				"apiVersion": "v1",
 				"kind":       "Service",
-				"metadata": map[string]interface{}{
+				"metadata": map[string]any{
 					"name":      "test-service",
 					"namespace": "default",
 				},

internal/extensionserver/post_translate_modify_test.go

@@ -189,27 +189,27 @@ func TestInsertAIGatewayExtProcFilter(t *testing.T) {
 }
 
 func TestServer_isRouteGeneratedByAIGateway(t *testing.T) {
-	emptyStruct, err := structpb.NewStruct(map[string]interface{}{})
+	emptyStruct, err := structpb.NewStruct(map[string]any{})
 	require.NoError(t, err)
 
-	structWithEmptyResources, err := structpb.NewStruct(map[string]interface{}{
+	structWithEmptyResources, err := structpb.NewStruct(map[string]any{
 		"resources": nil,
 	})
 	require.NoError(t, err)
 
-	withAnnotationsListStruct, err := structpb.NewStruct(map[string]interface{}{
-		"resources": []interface{}{
-			map[string]interface{}{
-				"annotations": map[string]interface{}{},
+	withAnnotationsListStruct, err := structpb.NewStruct(map[string]any{
+		"resources": []any{
+			map[string]any{
+				"annotations": map[string]any{},
 			},
 		},
 	})
 	require.NoError(t, err)
 
-	withOKAnnotationsListStruct, err := structpb.NewStruct(map[string]interface{}{
-		"resources": []interface{}{
-			map[string]interface{}{
-				"annotations": map[string]interface{}{
+	withOKAnnotationsListStruct, err := structpb.NewStruct(map[string]any{
+		"resources": []any{
+			map[string]any{
+				"annotations": map[string]any{
 					internalapi.AIGatewayGeneratedHTTPRouteAnnotation: "true",
 				},
 			},

internal/extproc/backendauth/gcp.go

@@ -80,7 +80,7 @@ func (g *gcpHandler) Do(_ context.Context, _ map[string]string, headerMut *extpr
 		&corev3.HeaderValueOption{
 			Header: &corev3.HeaderValue{
 				Key:      "Authorization",
-				RawValue: []byte(fmt.Sprintf("Bearer %s", g.gcpAccessToken)),
+				RawValue: fmt.Appendf(nil, "Bearer %s", g.gcpAccessToken),
 			},
 		},
 	)