Update pinned Go toolchain to 1.25.9

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25.7
+FROM golang:1.25.9
 
 # Set bash as default shell for features
 SHELL ["/bin/bash", "-c"]

.devcontainer/README.md

@@ -5,7 +5,7 @@ This dev container provides a complete, reproducible development environment for
 ## What's Included
 
 ### Development Tools
-- **Go 1.25.7** - Backend development
+- **Go 1.25.9** - Backend development
 - **Node.js 20** - Frontend development  
 - **gopls v0.17.0** - Go language server
 - **Delve** - Go debugger
@@ -225,7 +225,7 @@ Custom overrides: Create `.env.devcontainer` (gitignored)
 ## Resources
 
 - **VM Specs**: 8GB RAM, 30GB disk, 2 CPU cores
-- **Base Image**: `golang:1.25.7` (Ubuntu-based)
+- **Base Image**: `golang:1.25.9` (Ubuntu-based)
 - **Caches**: ~2-3GB for Go modules and build artifacts
 
 ## Tips & Tricks
@@ -247,7 +247,7 @@ MacBook (VS Code)
 dev-containers VM (Proxmox)
     ↓ Docker
 Dev Container
-    ├── Go 1.25.7 + tools
+    ├── Go 1.25.9 + tools
     ├── Node 20 + npm
     ├── Your code (/workspaces/pulse)
     ├── Hot reload watchers

.github/workflows/create-release.yml

@@ -238,7 +238,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Run backend tests
@@ -434,7 +434,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Build Pulse Docker image for integration tests
@@ -531,7 +531,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Set up Node.js

.github/workflows/deploy-demo-server.yml

@@ -77,7 +77,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Set up Node.js

Dockerfile

@@ -26,7 +26,7 @@ RUN --mount=type=cache,id=pulse-npm-cache,target=/root/.npm \
 # Build stage for Go backend
 # Force amd64 platform - Go cross-compiles for all targets anyway,
 # and this avoids slow QEMU emulation during multi-arch builds
-FROM --platform=linux/amd64 golang:1.25.7-alpine AS backend-builder
+FROM --platform=linux/amd64 golang:1.25.9-alpine AS backend-builder
 
 ARG BUILD_AGENT
 ARG PULSE_LICENSE_PUBLIC_KEY

go.mod

@@ -2,7 +2,7 @@ module github.com/rcourtman/pulse-go-rewrite
 
 go 1.25.0
 
-toolchain go1.25.7
+toolchain go1.25.9
 
 require (
 	github.com/IGLOU-EU/go-wildcard/v2 v2.1.0

install.sh

@@ -3023,7 +3023,7 @@ build_from_source() {
     original_dir=$(pwd)
     local temp_build=""
     # Keep this aligned with go.mod's toolchain directive for consistent builds and security posture.
-    local GO_MIN_VERSION="1.25.7"
+    local GO_MIN_VERSION="1.25.9"
     local GO_INSTALLED=false
     local arch=""
     local go_arch=""

scripts/.go-version

@@ -1 +1 @@
-go1.25.7
+go1.25.9

scripts/build-release.sh

@@ -12,7 +12,7 @@ if [ -x /usr/local/go/bin/go ]; then
 fi
 
 # Release artifacts must be built with the vetted toolchain to match security-gate evidence.
-required_go="go1.25.7"
+required_go="go1.25.9"
 current_go="$(go env GOVERSION 2>/dev/null || true)"
 if [[ "${PULSE_SKIP_GO_VERSION_CHECK:-false}" != "true" ]]; then
     if [[ "${current_go}" != "${required_go}" ]]; then

scripts/install-go-toolchain.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 VERSION_FILE="${SCRIPT_DIR}/.go-version"
-DEFAULT_VERSION="go1.25.7"
+DEFAULT_VERSION="go1.25.9"
 TARGET_ROOT="/opt/toolchains/go"
 DOWNLOAD_ROOT="https://dl.google.com/go"
 GOPATH_DIR="/var/lib/pulse/go"