V5.4 update Go to v1.25.3 (#3937)

* V5.4 update Go to v1.25.3

* also update circleci image

---------

Co-authored-by: Wout Slakhorst <[email protected]>

Author: gerardsn

.circleci/config.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     parallelism: 8
     docker:
-      - image: cimg/go:1.21
+      - image: cimg/go:1.25
     steps:
       - checkout
 
@@ -37,7 +37,7 @@ jobs:
 
   report:
     docker:
-      - image: cimg/go:1.21
+      - image: cimg/go:1.25
     steps:
       - checkout
       - attach_workspace:

Dockerfile

@@ -1,5 +1,5 @@
 # golang alpine
-FROM golang:1.24.6-alpine AS builder
+FROM golang:1.25.3-alpine AS builder
 
 ARG TARGETARCH
 ARG TARGETOS
@@ -21,7 +21,7 @@ COPY . .
 RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine
-FROM alpine:3.22.0
+FROM alpine:3.22.2
 RUN apk update \
   && apk add --no-cache \
              tzdata \

docs/pages/release_notes.rst

@@ -3,6 +3,23 @@
 Release notes
 #############
 
+*************************
+Hazelnut update (v5.4.20)
+*************************
+
+Release date: 2025-11-03
+
+- Update Go version to fix https://pkg.go.dev/vuln/GO-2025-4007,
+  https://pkg.go.dev/vuln/GO-2025-4008,
+  https://pkg.go.dev/vuln/GO-2025-4009,
+  https://pkg.go.dev/vuln/GO-2025-4010,
+  https://pkg.go.dev/vuln/GO-2025-4011,
+  https://pkg.go.dev/vuln/GO-2025-4012,
+  https://pkg.go.dev/vuln/GO-2025-4013, and
+  https://pkg.go.dev/vuln/GO-2025-4014
+
+**Full Changelog**: https://github.com/nuts-foundation/nuts-node/compare/v5.4.19...v5.4.20
+
 *************************
 Hazelnut update (v5.4.19)
 *************************

go.mod

@@ -2,7 +2,7 @@ module github.com/nuts-foundation/nuts-node
 
 // This is the minimal version, the actual go version is determined by the images in the Dockerfile
 // This version is used in automated tests such as the 'Scheduled govulncheck' action
-go 1.24.6
+go 1.25.3
 
 require (
 	github.com/alicebob/miniredis/v2 v2.33.0