update CI to use Go 1.25.5

dockerfiles/code-coverage-uploader/Dockerfile

@@ -9,6 +9,6 @@ RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
 RUN curl -sfLo /tmp/codecov https://uploader.codecov.io/latest/linux/codecov
 RUN chmod +x /tmp/codecov
 
-FROM golang:1.25.4
+FROM golang:1.25.5
 RUN apt-get update -y && apt-get dist-upgrade -y
 COPY --from=builder /tmp/codecov /usr/local/bin/codecov

dockerfiles/crane/Dockerfile

@@ -4,7 +4,7 @@
 FROM gcr.io/go-containerregistry/crane as crane
 FROM mikefarah/yq:4.49.2 AS yq
 
-FROM golang:1.25.4
+FROM golang:1.25.5
 COPY --from=yq /usr/bin/yq /usr/local/bin
 COPY --from=crane /ko-app/crane /usr/local/bin
 ENTRYPOINT ["bash"]

dockerfiles/gh-cli/Dockerfile

@@ -11,5 +11,5 @@ RUN curl \
     https://github.com/cli/cli/releases/download/v2.40.0/gh_2.40.0_linux_amd64.tar.gz \
     && tar -C /tmp --strip-components=1 -xzvf /tmp/gh.tar.gz
 
-FROM golang:1.25.4
+FROM golang:1.25.5
 COPY --from=builder /tmp/bin/gh /usr/local/bin/gh

dockerfiles/integration-test-runner-beta/Dockerfile

@@ -36,7 +36,7 @@ RUN google-chrome --version
 
 # Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
 ENV PATH /usr/local/go/bin:$PATH
-RUN curl -fsSL https://go.dev/dl/go1.25.3.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
+RUN curl -fsSL https://go.dev/dl/go1.25.5.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
     tar -C /usr/local -xzf /tmp/go.tar.gz && \
     rm /tmp/go.tar.gz && \
     go version

dockerfiles/integration-test-runner/Dockerfile

@@ -36,7 +36,7 @@ RUN google-chrome --version
 
 # Install Go. The download URL that can be used below for any version of Go can be found on https://go.dev/dl/
 ENV PATH /usr/local/go/bin:$PATH
-RUN curl -fsSL https://go.dev/dl/go1.25.3.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
+RUN curl -fsSL https://go.dev/dl/go1.25.5.linux-amd64.tar.gz -o /tmp/go.tar.gz && \
     tar -C /usr/local -xzf /tmp/go.tar.gz && \
     rm /tmp/go.tar.gz && \
     go version

dockerfiles/test-cfssl/Dockerfile

@@ -11,7 +11,7 @@ FROM cfssl/cfssl:v1.6.5 as cfssl
 
 # We just need any basic unix with bash, but we can pick the same
 # base image that they use, just in case they did any dynamic linking.
-FROM golang:1.25.4
+FROM golang:1.25.5
 
 # Thier Docerfile https://github.com/cloudflare/cfssl/blob/master/Dockerfile
 # calls their Makefile https://github.com/cloudflare/cfssl/blob/master/Makefile

pipelines/dockerfile-builders/pipeline.yml

@@ -38,7 +38,7 @@ meta:
   # These version numbers should be updated periodically.
   codegen-versions: &codegen-versions
     # Choose which version of Golang to use in the codegen container images.
-    BUILD_ARG_GO_VERSION: '1.25.3'
+    BUILD_ARG_GO_VERSION: '1.25.5'
     # Choose which version of sigs.k8s.io/controller-tools/cmd/controller-gen to install
     # in the codegen container images.
     BUILD_ARG_CONTROLLER_GEN_VERSION: 0.19.0

pipelines/pull-requests/pipeline.yml

@@ -606,7 +606,7 @@ jobs:
             type: registry-image
             source:
               repository: golang
-              tag: '1.25.3'
+              tag: '1.25.5'
           inputs:
             - name: pinniped-pr
           outputs:

pipelines/shared-helpers/test-binaries-image/Dockerfile

@@ -3,7 +3,7 @@
 # Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.25.4-bookworm as build-env
+FROM golang:1.25.5-bookworm as build-env
 WORKDIR /work
 COPY . .
 ARG GOPROXY

pipelines/shared-helpers/test-binaries-image/Dockerfile_fips

@@ -6,7 +6,7 @@
 # we need a separate dockerfile for the fips test image so that the integration tests
 # use the right ciphers etc.
 
-FROM golang:1.25.4-bookworm as build-env
+FROM golang:1.25.5-bookworm as build-env
 WORKDIR /work
 COPY . .
 ARG GOPROXY

pipelines/shared-tasks/build-cli-binaries/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped
   - name: pinniped-ci

pipelines/shared-tasks/confirm-built-with-fips/task.yml

@@ -10,6 +10,6 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 run:
   path: pinniped-ci/pipelines/shared-tasks/confirm-built-with-fips/task.sh

pipelines/shared-tasks/confirm-version/task.yml

@@ -10,7 +10,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 run:
   # Confirm that the correct git sha was baked into the executables and that they log the version as their
   # first line of output. Do this by directly running the server binary from the rootfs of the built image.

pipelines/shared-tasks/format-release/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped
   - name: release-semver

pipelines/shared-tasks/run-go-vuln-scan/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped
   - name: pinniped-ci

pipelines/shared-tasks/run-unit-tests/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped
   - name: pinniped-ci

pipelines/shared-tasks/run-verify-go-generate/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped
   - name: pinniped-ci

pipelines/shared-tasks/run-verify-go-mod-tidy/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped
   - name: pinniped-ci

pipelines/shared-tasks/run-verify-lint/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped
   - name: pinniped-ci

pipelines/shared-tasks/update-version-and-cli-docs/task.yml

@@ -7,7 +7,7 @@ image_resource:
   type: registry-image
   source:
     repository: golang
-    tag: '1.25.3'
+    tag: '1.25.5'
 inputs:
   - name: pinniped-ci
   - name: github-final-release