fix(security): upgrade Go to 1.25.5 to fix CVE-2025-61729

[GrammaTonic]

📋 Pull Request Description

🔀 Merge Strategy

This repository uses SQUASH MERGE as the standard merge strategy.

Summary

This PR fixes CVE-2025-61729, a HIGH severity security vulnerability in Go's standard library affecting version 1.25.4. This is a focused security fix with minimal changes.

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🔒 Security enhancement

Related Issues

• Fixes https://github.com/GrammaTonic/github-runner/security/code-scanning/5682

🔄 Changes Made

Files Modified

• docker/Dockerfile.chrome-go - Updated Go version from 1.25.4 to 1.25.5 (1 line change)

Key Changes

1. Upgraded Go from version 1.25.4 to 1.25.5 in Chrome-Go runner Dockerfile
2. Resolves CVE-2025-61729 - HIGH severity vulnerability in stdlib
3. Prevents excessive resource consumption from malicious certificates
4. Fixes quadratic runtime issue in HostnameError.Error() error string construction

Vulnerability Details

• CVE ID: CVE-2025-61729
• Severity: HIGH
• Affected Package: Go stdlib 1.25.4
• Fixed Versions: 1.24.11, 1.25.5
• Issue: Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. A certificate provided by a malicious actor can result in excessive resource consumption.
• Link: https://avd.aquasec.com/nvd/cve-2025-61729

🧪 Testing

Testing Performed

• Docker build will be validated by CI/CD pipeline
• Trivy security scanning will verify vulnerability is resolved
• All automated tests will run via GitHub Actions

Test Coverage

• Security scanning will validate the fix
• Existing tests cover Chrome-Go runner functionality

🔒 Security Considerations

• No new security vulnerabilities introduced
• Fixes HIGH severity CVE-2025-61729
• Container security best practices followed
• Minimal change (1 line) reduces risk

📚 Documentation

• Security fix documented in commit message
• CVE details included in PR description

🚀 Deployment Notes

• Docker image rebuild required for Chrome-Go runner
• No configuration changes needed
• No environment variable updates required

✅ Checklist

• I have performed a self-review of my code
• My changes generate no new warnings
• Security vulnerability has been addressed
• Change is minimal and focused (1 line change)

---

Note for Reviewers:

This is a critical security fix that should be merged and deployed promptly. The change is minimal (single line) and low-risk, upgrading Go to the patched version that resolves CVE-2025-61729. This PR contains ONLY the security fix, unlike PR #1072 which inadvertently included unrelated changes.

[gemini-code-assist]

Summary of Changes

Hello @GrammaTonic, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements a critical security update by upgrading the Go version used in the chrome-go Docker image. The primary goal is to mitigate a high-severity vulnerability (CVE-2025-61729) that could lead to resource exhaustion from specially crafted certificates. This ensures the stability and security of the application by preventing potential denial-of-service scenarios.

Highlights

• Security Fix: Upgraded Go from version 1.25.4 to 1.25.5 in the docker/Dockerfile.chrome-go to address CVE-2025-61729, a HIGH severity security vulnerability.
• Vulnerability Resolution: The fix prevents excessive resource consumption caused by malicious certificates and resolves a quadratic runtime issue in the HostnameError.Error() error string construction.
• Minimal Change: The change is highly focused, involving only a single line modification to update the Go version, minimizing risk.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly upgrades the Go version to 1.25.5 in docker/Dockerfile.chrome-go to mitigate the security vulnerability CVE-2025-61729. The change is accurate and necessary. While the change in this PR is correct, I've identified that the old Go version 1.25.4 is still referenced in other parts of the repository, which could cause inconsistencies. Specifically, docker/docker-compose.chrome-go.yml sets a default GO_VERSION environment variable to 1.25.4, and docs/features/MULTI_ARCH_CONTAINERS.md references GO_VERSION=1.25.4 in a code example. To ensure consistency and prevent potential issues, I recommend updating these references to 1.25.5 in a follow-up pull request. Apart from this observation, the current change is good to go.