chore(deps): Bump go directive to 1.25.11 (#3114)

chore(tooling): Write full Go version to go.mod directive

Signed-off-by: Wassim DHIF <wassim.dhif@datadoghq.com>

chore(deps): Bump go directive to 1.25.11

Signed-off-by: Wassim DHIF <wassim.dhif@datadoghq.com>

Update hack/update-golang.sh

Co-authored-by: Timothée Bavelier <97530782+tbavelier@users.noreply.github.com>

fix: Explicit patch version in update-golang.sh

Signed-off-by: Wassim DHIF <wassim.dhif@datadoghq.com>

Update hack/update-golang.sh

Co-authored-by: Timothée Bavelier <97530782+tbavelier@users.noreply.github.com>

Co-authored-by: wassim.dhif <wassim.dhif@datadoghq.com>

Author: wdhif

go.mod

@@ -1,8 +1,6 @@
 module github.com/DataDog/datadog-operator
 
-go 1.25.7
-
-toolchain go1.25.11
+go 1.25.11
 
 require (
 	github.com/DataDog/datadog-agent/pkg/util/scrubber v0.63.0-rc.1 // indirect

hack/update-golang.sh

@@ -100,18 +100,32 @@ else
     echo "Warning: $actions_directory not found, skipping."
 fi
 
-# Update go.mod files
-go_mod_files="$ROOT/go.mod $ROOT/test/e2e/go.mod $ROOT/api/go.mod"
+# Update non-api go.mod files with the full Go patch version so static SCA
+# scanners don't flag patch-level stdlib CVEs that are already cleared by the
+# toolchain directive.
+go_mod_files="$ROOT/go.mod $ROOT/test/e2e/go.mod"
 for file in $go_mod_files; do
     if [[ -f $file ]]; then
         echo "Processing $file..."
-        go mod edit -go $new_minor_version $file
-        go mod edit -toolchain go$GOVERSION $file
+        go mod edit -go $GOVERSION $file
     else
         echo "Warning: $file not found, skipping."
     fi
 done
 
+# api/go.mod stays at initial patch release for the minor Go version: it is a types-only CRD module imported by
+# external projects (Agent, EDS, dd-source autoscaling, ...). A stricter `go`
+# directive would force consumers off Go n-1 for no real benefit since the
+# module ships no runtime code that could trigger stdlib CVEs.
+api_go_mod="$ROOT/api/go.mod"
+if [[ -f $api_go_mod ]]; then
+    echo "Processing $api_go_mod..."
+    go mod edit -go ${new_minor_version}.0 $api_go_mod
+    go mod edit -toolchain go$GOVERSION $api_go_mod
+else
+    echo "Warning: $api_go_mod not found, skipping."
+fi
+
 # Run go work sync
 echo "Running go work sync..."
 go work sync

test/e2e/go.mod

@@ -1,8 +1,6 @@
 module github.com/DataDog/datadog-operator/test/e2e
 
-go 1.25.8
-
-toolchain go1.25.11
+go 1.25.11
 
 require (
 	github.com/DataDog/datadog-agent/test/e2e-framework v0.78.0-devel