chore(ci): bump Go toolchain to 1.25.14

[Vligai]

Description 📣

The pinned Go toolchain was 1.25.12, which was the current 1.25 patch when it was set on 9 July.
1.25.14 shipped on 19 August. This raises the pin across go.mod, e2e/go.mod and the six workflows
that call setup-go.

1.25.14 covers every standard-library advisory the govulncheck gate was carrying an exception for,
so STDLIB_ALLOWLIST is removed rather than trimmed. GO-2026-5942 was listed there as needing
stdlib@go1.26.6, but its fix range has no 1.25 entry because the 1.25 line was never affected, and
govulncheck does not report it on 1.25.12 either. DEP_ALLOWLIST is unchanged.

Also bumps golang.org/x/crypto to v0.55.0, clearing GO-2026-6303, where source-address critical
options were not enforced for non-public-key auth callbacks in x/crypto/ssh. The repo sets no
source-address critical options anywhere, so that enforcement change has nothing to act on here.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

Run against the pinned toolchain rather than whatever is on PATH, since the go directive is a
minimum and a newer local Go will satisfy it silently:

export GOTOOLCHAIN=go1.25.14
go build ./...
(cd e2e && go build ./...)
go test ./... -count=1

go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
CGO_ENABLED=0 govulncheck -scan module

Results:

• go build ./... and the e2e module both build clean
• 11 test packages pass
• govulncheck reports GO-2026-5932, GO-2026-6354 and GO-2026-6355

Pre-existing failures, unchanged by this PR and reproducible on main at its own 1.25.12 pin:

• detect/config and packages/cmd fail the vet subset that go test applies, on five
  non-constant format strings. CI does not see them because run-cli-tests.yml runs only
  go test -v -count=1 ./test. Confirm with:
  git worktree add --detach /tmp/chk main && cd /tmp/chk && GOTOOLCHAIN=go1.25.12 go vet ./packages/cmd/
• test needs the eight CLI_TESTS_* credentials

Known gap

The govulncheck gate still fails, on GO-2026-6354 and GO-2026-6355. Both are fixed in
golang.org/x/crypto v0.56.0, which declares go 1.26.0 and cannot be resolved on this pin:

go: golang.org/x/crypto@v0.56.0 requires go >= 1.26.0 (running go 1.25.14)

This is an improvement rather than a regression. main currently fails on those two plus
GO-2026-6303, so the count goes from three to two. Allowlisting the remainder would break the rule
the workflow sets for itself, that an entry must have no fixed version available and be absent from
the build graph. Both have a published fix, and x/crypto/ssh is imported in seven files.

Clearing them requires moving to the 1.26 line. Worth noting separately that go1.27.0 shipped on
18 August, so with 1.27 and 1.26 as the two supported lines, 1.25 no longer receives fixes.

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-382-chore-ci-bump-go-toolchain-to-1-25-13

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​golang.org/​x/​crypto@​v0.54.0 ⏵ v0.55.0	+1

View full report

[greptile-apps]

Greptile Summary

The PR consistently raises the repository and CI Go toolchain pins from 1.25.12 to 1.25.13 and upgrades golang.org/x/crypto to v0.55.0.

• Updates both Go module directives and all active setup-go workflow pins.
• Removes the obsolete standard-library vulnerability allowlist.
• Refreshes transitive module checksums and versions associated with the dependency upgrade.

Confidence Score: 5/5

The PR appears safe to merge, with no new actionable defect identified in the coordinated toolchain and dependency updates.

The Go version is pinned consistently across both modules and all active workflows, the dependency refresh has no established incompatible call path, and the remaining vulnerability-gate failures are documented pre-existing limitations that this change reduces rather than introduces.

Important Files Changed

Filename	Overview
.github/workflows/govulncheck.yml	Updates the pinned toolchain and removes standard-library advisory exceptions now covered by Go 1.25.13; the remaining dependency findings are explicitly documented.
.github/workflows/release_build_infisical_cli.yml	Consistently updates all release build jobs from Go 1.25.12 to 1.25.13.
.github/workflows/run-cli-e2e-tests.yml	Updates all end-to-end test jobs to the same Go 1.25.13 pin.
.github/workflows/run-cli-smoke-tests.yml	Updates the distribution smoke-test toolchain without changing build or validation behavior.
.github/workflows/run-cli-tests.yml	Updates the CLI test workflow to Go 1.25.13 with no other behavioral changes.
.github/workflows/test-update-instructions.yml	Updates every platform job in the update-instructions test workflow to Go 1.25.13.
go.mod	Raises the minimum Go patch release and upgrades x/crypto to v0.55.0 with a compatible indirect x/text refresh.
e2e/go.mod	Keeps the end-to-end test module's Go directive aligned with the root module and CI.
go.sum	Refreshes checksums for the selected x/crypto, x/text, and transitive x/tools versions.

_{Reviews (1): Last reviewed commit: "chore(ci): bump Go toolchain to 1.25.13" | Re-trigger Greptile}

[veria-ai]

Low: Reachable SSH denial of service is exempted from the gate

A malicious SSH peer can deadlock a tunnel connection through GO-2026-6354 or GO-2026-6355 because the production code calls affected APIs including ssh.Dial, ssh.NewServerConn, ssh.NewClientConn, and channel Accept. Adding these IDs to ALLOWLIST lets releases using vulnerable x/crypto v0.55.0 pass the security gate; move to v0.56.0 with a compatible toolchain or backport the upstream fixes instead of suppressing these findings.

[veria-ai]

PR overview

This pull request updates the CI environment to Go toolchain 1.25.14 and adjusts the govulncheck workflow configuration.

One security issue remains open: the vulnerability gate exempts reachable SSH flaws that can let a malicious peer deadlock tunnel connections, causing denial of service. As a result, releases using the affected x/crypto version can pass the gate without the upstream fixes.

Open issues (1)

• Low: Reachable SSH denial of service is exempted from the gate — .github/workflows/govulncheck.yml:60

Fixed/addressed: 0 · PR risk: 6/10