From fb7b9b01fc1264dfc247f3230aa58792fdb0d23f Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Sat, 18 Apr 2026 10:04:34 +0100
Subject: [PATCH] Update pinned Go toolchain to 1.25.9

---
 .devcontainer/Dockerfile                 | 2 +-
 .devcontainer/README.md                  | 6 +++---
 .github/workflows/create-release.yml     | 6 +++---
 .github/workflows/deploy-demo-server.yml | 2 +-
 Dockerfile                               | 2 +-
 go.mod                                   | 2 +-
 install.sh                               | 2 +-
 scripts/.go-version                      | 2 +-
 scripts/build-release.sh                 | 2 +-
 scripts/install-go-toolchain.sh          | 2 +-
 10 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index c7925819f..5305e24e0 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.7
+FROM golang:1.25.9
 
 # Set bash as default shell for features
 SHELL ["/bin/bash", "-c"]
diff --git a/.devcontainer/README.md b/.devcontainer/README.md
index 92d05c1c8..ed65a0eeb 100644
--- a/.devcontainer/README.md
+++ b/.devcontainer/README.md
@@ -5,7 +5,7 @@ This dev container provides a complete, reproducible development environment for
 ## What's Included
 
 ### Development Tools
-- **Go 1.25.7** - Backend development
+- **Go 1.25.9** - Backend development
 - **Node.js 20** - Frontend development  
 - **gopls v0.17.0** - Go language server
 - **Delve** - Go debugger
@@ -225,7 +225,7 @@ Custom overrides: Create `.env.devcontainer` (gitignored)
 ## Resources
 
 - **VM Specs**: 8GB RAM, 30GB disk, 2 CPU cores
-- **Base Image**: `golang:1.25.7` (Ubuntu-based)
+- **Base Image**: `golang:1.25.9` (Ubuntu-based)
 - **Caches**: ~2-3GB for Go modules and build artifacts
 
 ## Tips & Tricks
@@ -247,7 +247,7 @@ MacBook (VS Code)
 dev-containers VM (Proxmox)
     ↓ Docker
 Dev Container
-    ├── Go 1.25.7 + tools
+    ├── Go 1.25.9 + tools
     ├── Node 20 + npm
     ├── Your code (/workspaces/pulse)
     ├── Hot reload watchers
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 268a92d6e..f06a70398 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -238,7 +238,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Run backend tests
@@ -434,7 +434,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Build Pulse Docker image for integration tests
@@ -531,7 +531,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Set up Node.js
diff --git a/.github/workflows/deploy-demo-server.yml b/.github/workflows/deploy-demo-server.yml
index e359ddc2a..35fc99e5a 100644
--- a/.github/workflows/deploy-demo-server.yml
+++ b/.github/workflows/deploy-demo-server.yml
@@ -77,7 +77,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.7'
+          go-version: '1.25.9'
           cache: true
 
       - name: Set up Node.js
diff --git a/Dockerfile b/Dockerfile
index 413b9421d..deff63943 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -26,7 +26,7 @@ RUN --mount=type=cache,id=pulse-npm-cache,target=/root/.npm \
 # Build stage for Go backend
 # Force amd64 platform - Go cross-compiles for all targets anyway,
 # and this avoids slow QEMU emulation during multi-arch builds
-FROM --platform=linux/amd64 golang:1.25.7-alpine AS backend-builder
+FROM --platform=linux/amd64 golang:1.25.9-alpine AS backend-builder
 
 ARG BUILD_AGENT
 ARG PULSE_LICENSE_PUBLIC_KEY
diff --git a/go.mod b/go.mod
index 2dd55b474..31d03e142 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/rcourtman/pulse-go-rewrite
 
 go 1.25.0
 
-toolchain go1.25.7
+toolchain go1.25.9
 
 require (
 	github.com/IGLOU-EU/go-wildcard/v2 v2.1.0
diff --git a/install.sh b/install.sh
index 19aee9132..ea018118e 100755
--- a/install.sh
+++ b/install.sh
@@ -3023,7 +3023,7 @@ build_from_source() {
     original_dir=$(pwd)
     local temp_build=""
     # Keep this aligned with go.mod's toolchain directive for consistent builds and security posture.
-    local GO_MIN_VERSION="1.25.7"
+    local GO_MIN_VERSION="1.25.9"
     local GO_INSTALLED=false
     local arch=""
     local go_arch=""
diff --git a/scripts/.go-version b/scripts/.go-version
index 5a5b5883b..6f9fcdf1f 100644
--- a/scripts/.go-version
+++ b/scripts/.go-version
@@ -1 +1 @@
-go1.25.7
+go1.25.9
diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index 14088264f..7bf200474 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -12,7 +12,7 @@ if [ -x /usr/local/go/bin/go ]; then
 fi
 
 # Release artifacts must be built with the vetted toolchain to match security-gate evidence.
-required_go="go1.25.7"
+required_go="go1.25.9"
 current_go="$(go env GOVERSION 2>/dev/null || true)"
 if [[ "${PULSE_SKIP_GO_VERSION_CHECK:-false}" != "true" ]]; then
     if [[ "${current_go}" != "${required_go}" ]]; then
diff --git a/scripts/install-go-toolchain.sh b/scripts/install-go-toolchain.sh
index 97028f7d8..233cce50a 100755
--- a/scripts/install-go-toolchain.sh
+++ b/scripts/install-go-toolchain.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 VERSION_FILE="${SCRIPT_DIR}/.go-version"
-DEFAULT_VERSION="go1.25.7"
+DEFAULT_VERSION="go1.25.9"
 TARGET_ROOT="/opt/toolchains/go"
 DOWNLOAD_ROOT="https://dl.google.com/go"
 GOPATH_DIR="/var/lib/pulse/go"