bump go version to 1.25.8 to fix CVE-2026-25679 and CVE-2026-27142 (#2023)

Author: nlu90

.github/workflows/ci-bookie-checks.yml

@@ -11,10 +11,10 @@ jobs:
   bookie-ut-tests:
     runs-on: ubuntu-latest
     steps:
-    - name: Set up Go 1.25
+    - name: Set up Go 1.25.8
       uses: actions/setup-go@v6
       with:
-        go-version: 1.25
+        go-version: 1.25.8
       id: go
     - name: Check out code into the Go module directory
       uses: actions/checkout@v2

.github/workflows/ci-functions-checks.yml

@@ -13,10 +13,10 @@ jobs:
     steps:
     - name: Login SN docker hub
       run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}"
-    - name: Set up Go 1.25
+    - name: Set up Go 1.25.8
       uses: actions/setup-go@v6
       with:
-        go-version: 1.25
+        go-version: 1.25.8
       id: go
     - name: Check out code into the Go module directory
       uses: actions/checkout@v2
@@ -30,10 +30,10 @@ jobs:
     steps:
       - name: Login SN docker hub
         run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}"
-      - name: Set up Go 1.25
+      - name: Set up Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: 1.25
+          go-version: 1.25.8
         id: go
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -44,10 +44,10 @@ jobs:
     steps:
       - name: Login SN docker hub
         run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}"
-      - name: Set up Go 1.25
+      - name: Set up Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: 1.25
+          go-version: 1.25.8
         id: go
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2

.github/workflows/ci-packages-checks.yml

@@ -13,10 +13,10 @@ jobs:
     steps:
       - name: Login SN docker hub
         run: docker login -u="${{ secrets.DOCKER_USER }}" -p="${{ secrets.DOCKER_PASSWORD}}"
-      - name: Set up Go 1.25
+      - name: Set up Go 1.25.8
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25
+          go-version: 1.25.8
         id: go
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2

.github/workflows/ci-release-checks.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [ 1.25 ]
+        go-version: [ 1.25.8 ]
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v5

.github/workflows/ci-style-checks.yml

@@ -11,10 +11,10 @@ jobs:
   style-check:
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.25
+      - name: Set up Go 1.25.8
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25
+          go-version: 1.25.8
         id: go
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2

.github/workflows/ci-trivy.yml

@@ -12,10 +12,10 @@ jobs:
   scan-vulnerabilities:
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.25
+      - name: Set up Go 1.25.8
         uses: actions/setup-go@v5
         with:
-          go-version: 1.25
+          go-version: 1.25.8
         id: go
 
       - name: Check out code into the Go module directory
@@ -34,4 +34,4 @@ jobs:
           format: 'table'
           exit-code: '1'
           severity: "MEDIUM,HIGH,CRITICAL"
-          vuln-type: "library"
+          vuln-type: "library"

go.mod

@@ -1,6 +1,6 @@
 module github.com/streamnative/pulsarctl
 
-go 1.25.7
+go 1.25.8
 
 require (
 	github.com/apache/pulsar-client-go v0.18.0-candidate-1.0.20251222030102-3bb7d4eff361

scripts/test-docker/Dockerfile

@@ -8,7 +8,7 @@ USER root
 RUN apk update && apk add curl git build-base
 
 # install golang
-COPY --from=golang:1.25.5-alpine /usr/local/go/ /usr/local/go/
+COPY --from=golang:1.25.8-alpine /usr/local/go/ /usr/local/go/
 ENV PATH /usr/local/go/bin:$PATH