[3.3.8] Bump golang.org/x modules and align Go version to 1.25.14

[bbrks]

Latest golang.org/x/* releases that Go 1.25 will take:

golang.org/x/crypto v0.39.0 => v0.55.0
golang.org/x/net    v0.41.0 => v0.58.0
golang.org/x/oauth2 v0.30.0 => v0.36.0
golang.org/x/sys    v0.33.0 => v0.47.0
golang.org/x/text   v0.26.0 => v0.41.0
golang.org/x/time    v0.3.0 => v0.15.0

x/crypto stops at v0.55.0 - v0.56.0 needs go1.26.0. x/exp left alone, it's pseudo-versioned with no tagged releases.

Go version bump comes with it rather than being optional - x/crypto v0.49.0+ and x/net v0.51.0+ both declare go1.25.0, so go get won't apply them under a go 1.24.3 directive. manifest/product-config.json already has 3.3.8 building on 1.25.14 whilst go.mod was on 1.24.3, ci.yml/Jenkinsfile on 1.24.4 and service.yml as far back as 1.23.3 - all four now say 1.25.14.

Lint needed bumping with it - golangci-lint v2.0.2 is built with go1.24 and won't even load a config targeting a newer language version (can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.14)). Moved to v2.8.0 to match 4.0.8, which turns up one pre-existing misspell hit in base/dcp_dest.go that v2.0.2 never caught - 4.0.8, 4.1.2 and main all spell it implemented already, so that's 3.3.8 catching up rather than a new change.

go build, go vet, yamllint and the unit suite all pass locally with cb_sg_enterprise,cb_sg_devmode.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Large Go toolchain and core golang.org/x/{crypto,net} upgrades can have broad runtime/regression impact and should be validated by full CI before approval.

Pull request overview

Updates the Sync Gateway 3.3.8 release branch to build/test with Go 1.25.14 and bumps golang.org/x/* dependencies to the latest versions compatible with Go 1.25, keeping CI and build tooling aligned with the module requirements.

Changes:

• Bump golang.org/x/crypto, x/net, x/oauth2, x/sys, x/text, and x/time dependency versions.
• Update the module go version directive to 1.25.14.
• Align GitHub Actions workflows and Jenkins pipeline to use Go 1.25.14.

File summaries

File	Description
go.mod	Updates Go version directive and bumps golang.org/x/* module requirements.
go.sum	Refreshes module checksums to match the upgraded golang.org/x/* dependencies.
.github/workflows/ci.yml	Pins CI jobs to Go 1.25.14 to match the updated module/toolchain baseline.
.github/workflows/service.yml	Pins service install workflow build to Go 1.25.14.
Jenkinsfile	Updates Jenkins Go tool version to 1.25.14 for pipeline builds.

Review details

• Files reviewed: 4/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.