chore(deps): bump Go to 1.26 everywhere

[mdelapenya]

What does this PR do?

• Bumps the minimal Go version to 1.26 in all go.mod files (go 1.26.0, toolchain go1.26.8).
• CI matrix now tests 1.26.x and 1.27.x; Sonar runs on 1.26.x. Drops the Go 1.25 skip for weaviate.
• Bumps golangci-lint to v2.14.0 (built with Go 1.26) and fixes its new findings.
• Updates CI docs, the compose minimal Go version note, test Dockerfiles (golang:1.26-alpine by digest), devcontainer and AI.md.
• Fixes scripts/bump-go.sh: it compared the three-part go.mod version against the two-part version used everywhere else, so only go.mod lines were bumped. It now also handles toolchain, Dockerfile digests, the CircleCI patch versions and AI.md.

Why is it important?

Go 1.25 reached end of life with the Go 1.27 release (https://endoflife.date/go).

Related issues

• Supersedes chore: bump Go version to 1.26 #3836
• Supersedes and Closes docs: update compose module minimum Go version to 1.25 #3895

How to test this PR

• make tidy-all produces no changes.
• make lint in the core module and golangci-lint run in every module pass with v2.14.0.
• Dry-run of the script for the next bump: ./scripts/bump-go.sh 1.27.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for testcontainers-go ready!

Name	Link
🔨 Latest commit	0de3222
🔍 Latest deploy log	https://app.netlify.com/projects/testcontainers-go/deploys/6ac3a7e669338a0008deafc7
😎 Deploy Preview	https://deploy-preview-3940--testcontainers-go.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c3d23483-51a5-41e5-a3e8-21e4e3872f76

📥 Commits

Reviewing files that changed from the base of the PR and between f75fdf3 and 0de3222.

📒 Files selected for processing (7)

• modules/dind/go.mod
• modules/dockermcpgateway/go.mod
• modules/dockermodelrunner/go.mod
• modules/k6/go.mod
• modules/neo4j/go.mod
• modules/redpanda/go.mod
• modules/vearch/go.mod

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Summary by CodeRabbit

• Compatibility
  • Go 1.26 is now required to build the project and its modules. Update your Go toolchain before upgrading.
• Documentation
  • Setup instructions and CI examples now use Go 1.26, with test matrices covering Go 1.26 and 1.27.
• Bug Fixes
  • Improved handling of nil values and corrected logging of streamed model-pull responses.

Walkthrough

The repository now targets Go 1.26 across its modules, build environments, and CI configuration. The Go-version update script resolves patch versions and image digests and updates additional version references. Several code changes adjust reflection checks, logging, HTTP dialing, test data, and expression syntax.

Changes

Go 1.26 rollout

Layer / File(s)	Summary
Go version update automation scripts/bump-go.sh	The script validates version input, resolves patch releases and Alpine image digests, and updates module directives, toolchains, CI, documentation, and Dockerfiles. It remains dry-run by default.
Module and build environment versions go.mod, modules/**/go.mod, examples/nginx/go.mod, modulegen/go.mod, usage-metrics/go.mod, wait/testdata/http/go.mod, .devcontainer/devcontainer.json, AI.md, docs/features/docker_compose.md, **/*.Dockerfile	Go module and toolchain versions change to Go 1.26. Container images and developer guidance also use Go 1.26.
CI workflows and examples .github/workflows/*, commons-test.mk, docs/system_requirements/ci/*	Go test matrices move to Go 1.26 and 1.27. The Go-version skip gate is removed from the test workflow. The golangci-lint version changes to v2.14.0.

Go code adjustments

Layer / File(s)	Summary
Runtime code and expression changes cleanup.go, docker_mounts.go, modules/azure/lowkeyvault/testdata/main.go, modules/dockermodelrunner/internal/sdk/client/pull.go, modules/openfga/openfga.go, modules/**/options.go, wait/http.go, logconsumer_test.go, wait/log_test.go	The nil check uses reflect.Pointer; Docker mount logging uses the mapped mount type; and response lines use a fixed format string. The HTTP dialer no longer sets DualStack, and Azure test data reads fetched.Value. Several expressions and interface assertions change syntax.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Suggested reviewers: stevenh

Merge Risk: ⚪ Minimal · up to 0de32

The Go version updates align across the reviewed modules and CI, with no identified merge-blocking behavior. The PR is ready to merge after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 0de32

The reviewed changes are concentrated in build and test environments. Existing CI permission boundaries and Go builder-image pinning are preserved. Version-update automation can leave partially synchronized configuration after failure or interruption, but no introduced authority escalation was established. Broader runtime coverage remains incomplete.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The reviewed authority surface covers maintainer-controlled repository edits, CI build/test execution and externally selected Go builder images. The inspected Dockerfiles build test servers; these sources do not establish a production tenant, IAM or data-store authority expansion.

Trust Boundaries and Controls

• observed — The reusable workflow retains contents-read permission, an explicit cloud input gate for token-consuming setup, and main-branch/repository-owner restrictions for Sonar. The removed compatibility check excluded only weaviate on Go 1.25; neither remaining matrix version satisfies that exclusion. The inspected workflow comparison does not widen permissions or secret inheritance.

Resilience and Maintainability Implications

• observed — Failed remote resolution is handled by warning and retaining the old image digest, or selecting a .0 Go patch fallback. These degraded states require review to establish that the intended security baseline was reached; warnings alone do not verify successful dependency refresh.

Hardening Proposals

• proposed — Consider requiring successful, validated patch and digest selection before apply-mode writes, and checking that selected identities match the requested baseline. This would reduce future configuration drift; it is not a claim that the reviewed head uses unpinned Go builder images.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 54.84% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 31 functions across 25 files. (7 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: raising the Go version to 1.26 across the project.
Description check	✅ Passed	The description explains the Go version upgrade, related CI and tooling changes, script updates, and testing performed.
Linked Issues check	✅ Passed	[ #3895 ] requests an update to the Compose module’s minimum Go version. modules/compose/go.mod now declares Go 1.26.0, and docs/features/docker_compose.md documents Go 1.26. This meets the reques…
Out of Scope Changes check	✅ Passed	The broader module, CI, documentation, Docker image, and devcontainer updates support the PR’s stated repository-wide Go 1.26 upgrade. The golangci-lint update and associated source edits support th…

Full details: Docstring Coverage

Explanation

Docstring coverage is 54.84% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 31 functions across 25 files. (7 skipped: 7 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the Go-version trail,
Past fresh toolchains and images pale.
The tests now hop through newer rows,
While logs use formats, clear as prose.
The carrot’s tagged, the burrow’s bright,
All tidy builds before the night.}

_{Comment @coderabbitai help to get the list of available commands.}