chore: bump Go to 1.25.7 (#4877)

* fix: move WaitGroup.Add inside watch() to fix Go 1.25 vet check

Go 1.25 added a vet check that flags WaitGroup.Add called from inside
a new goroutine. Move wg.Add(1) from the goroutine callback into the
watch() method itself, keeping it paired with its defer wg.Done().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: revise update-go-version skill per review feedback

- Skill now calls tools/upgrade-go-version.sh for CI/Dockerfile/release
  updates instead of duplicating its logic
- go directive only updated when a dependency or language feature
  requires it (not automatically on every minor bump)
- toolchain directive updated on every bump (patch and minor)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: make upgrade-go-version.sh portable across macOS and Linux

Use sed -i.bak instead of sed -i for cross-platform compatibility.
BSD sed (macOS) requires a backup extension with -i, while GNU sed
(Linux) treats it as optional. The .bak files are cleaned up after.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Update golang version to 1.25.7

* Update Go toolchain to go1.25.7

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: marcsanmi

.claude/skills/update-go-version/SKILL.md

@@ -39,43 +39,41 @@ Report these to the user before making changes.
 
 ### 2. Determine bump type
 
-Compare the target version against the current `go` directive in `go.mod`:
+Compare the target version against the current `toolchain` directive in `go.mod`:
 
-- **Same minor** (e.g. current `go 1.25.0`, target `1.25.7`): this is a **patch bump**. Only the `toolchain` directive and build/CI files need updating. The `go` directive stays as-is.
-- **Different minor** (e.g. current `go 1.24.6`, target `1.25.7`): this is a **minor bump**. Both the `go` directive and `toolchain` directive need updating, plus build/CI files.
+- **Same minor** (e.g. current `toolchain go1.25.3`, target `1.25.7`): **patch bump**. Only the `toolchain` directive and build/CI files need updating.
+- **Different minor** (e.g. current `toolchain go1.24.9`, target `1.25.7`): **minor bump**. The `toolchain` directive and build/CI files need updating. Ask the user whether to also update the `go` directive (see step 4).
 
 Tell the user which type was detected before proceeding.
 
-### 3. Update go.mod and go.work files
+### 3. Run the upgrade script
 
-**Important:** Do NOT run `go mod tidy` or `go work sync` manually. Step 7 handles module synchronization correctly using `make go/mod`.
+The `tools/upgrade-go-version.sh` script handles CI, Dockerfile, and release config updates. It also creates a git commit with those changes:
 
-#### For a minor bump
-
-The `go` directive sets the minimum compatible version, the `toolchain` directive sets the exact build version. They MUST be different to prevent Go from dropping the `toolchain` line.
-
-- Set `go` directive to `X.Y.0` (the base of the new minor)
-- Set `toolchain` directive to `goX.Y.Z` (the exact target patch version, which must be > X.Y.0)
-
-Use two separate `go mod edit` calls to ensure the toolchain line is preserved:
 ```bash
-go mod edit -go=X.Y.0 <file>
-go mod edit -toolchain=goX.Y.Z <file>
+bash tools/upgrade-go-version.sh X.Y.Z
 ```
 
-If using a single `go mod edit -go=X.Y.0 -toolchain=goX.Y.Z` and both values are the same, Go will DROP the toolchain line. Always ensure they differ.
+This updates and commits:
+- `.github/workflows/*.yml` — `go-version:` values
+- `.goreleaser.yaml` — version check hook
+- `.pyroscope.yaml` — `ref:` for Go stdlib source linking and `GO_VERSION`
+- `tools/update_examples.Dockerfile` — `GO_VERSION` ARG
+- All Go Dockerfiles — `FROM golang:` base image tag (excluding ebpf testdata)
 
-#### For a patch bump
+### 4. Update `toolchain` directive in go.mod and go.work files
 
-Update only the `toolchain` directive to `goX.Y.Z` in all go.mod files and the root `go.work`. Do NOT change the `go` directive.
+Update the `toolchain` directive to `goX.Y.Z` in all go.mod files using `go mod edit`, and the root `go.work` using `go work edit`:
 
 ```bash
+# For go.mod files:
 go mod edit -toolchain=goX.Y.Z <file>
-```
 
-#### Files to update
+# For go.work files (go mod edit does NOT work on .work files):
+go work edit -toolchain=goX.Y.Z <file>
+```
 
-**go.mod files (all need both `go` and `toolchain` for minor bumps, only `toolchain` for patch bumps):**
+**go.mod files:**
 - `go.mod`
 - `api/go.mod`
 - `lidia/go.mod`
@@ -86,114 +84,81 @@ go mod edit -toolchain=goX.Y.Z <file>
 - `examples/language-sdk-instrumentation/golang-push/rideshare-k6/go.mod`
 - `examples/language-sdk-instrumentation/golang-push/simple/go.mod`
 
-**go.work files (edit directly with sed or text editing):**
-- `go.work` (has both `go` and `toolchain` lines)
-- `examples/golang-pgo/go.work` (only `go` line, no `toolchain`)
-- `examples/tracing/golang-push/go.work` (only `go` line)
-- `examples/language-sdk-instrumentation/golang-push/rideshare/go.work` (only `go` line)
-- `examples/language-sdk-instrumentation/golang-push/rideshare-alloy/go.work` (only `go` line)
-- `examples/language-sdk-instrumentation/golang-push/rideshare-k6/go.work` (only `go` line)
-- `examples/language-sdk-instrumentation/golang-push/simple/go.work` (only `go` line)
-
-For go.work files:
-- **Minor bump**: update the `go` directive to `X.Y.0` in all go.work files, and update the `toolchain` directive to `goX.Y.Z` in the root `go.work`.
-- **Patch bump**: update only the `toolchain` directive to `goX.Y.Z` in the root `go.work`. Do not touch example go.work files (they have no `toolchain` line).
-
-### 4. Update CI workflows
+**go.work (root only — use `go work edit`):**
+- `go.work`
 
-Update `go-version:` in all GitHub Actions workflow files to the exact target version `X.Y.Z`. The version may be quoted or unquoted:
+#### Optional: update `go` directive (minor bump only)
 
-Files to update (check each one):
-- `.github/workflows/ci.yml` (6 occurrences)
-- `.github/workflows/fuzzer.yml`
-- `.github/workflows/release.yml`
-- `.github/workflows/test-examples.yml`
-- `.github/workflows/update-contributors.yml`
-- `.github/workflows/weekly-release.yml`
+The `go` directive sets the **minimum compatible Go version**. Only update it when:
+- A dependency requires a newer Go version
+- The codebase uses a Go language feature from the newer minor version
+- The user explicitly requests it
 
-### 5. Update Dockerfiles
+If updating the `go` directive, the `go` and `toolchain` values MUST differ to prevent Go from dropping the `toolchain` line. Use two separate calls:
 
-Update `FROM golang:` base images to the exact target version `X.Y.Z` in all Go example Dockerfiles.
-
-Find them with:
 ```bash
-git ls-files '**/Dockerfile*' | xargs grep -l 'golang:[0-9]' | grep -v ebpf/symtab/elf/testdata
-```
+# For go.mod files:
+go mod edit -go=X.Y.0 <file>
+go mod edit -toolchain=goX.Y.Z <file>
 
-**Do NOT touch:**
-- Non-Go Dockerfiles (dotnet, java, python, nodejs — they don't use `golang:` images)
-- `examples/grafana-alloy-auto-instrumentation/ebpf-otel/Dockerfile.demo` (uses `golang:1.22-alpine`, intentionally pinned to an older version)
-- Any Dockerfile under `ebpf/symtab/elf/testdata/`
+# For go.work files (go mod edit does NOT work on .work files):
+go work edit -go=X.Y.0 <file>
+go work edit -toolchain=goX.Y.Z <file>
+```
 
-### 6. Update build and release configuration
+Also update the `go` directive in all go.work files (use `go work edit`):
+- `go.work`
+- `examples/golang-pgo/go.work`
+- `examples/tracing/golang-push/go.work`
+- `examples/language-sdk-instrumentation/golang-push/rideshare/go.work`
+- `examples/language-sdk-instrumentation/golang-push/rideshare-alloy/go.work`
+- `examples/language-sdk-instrumentation/golang-push/rideshare-k6/go.work`
+- `examples/language-sdk-instrumentation/golang-push/simple/go.work`
 
-- **`.goreleaser.yaml`**: Update the version check hook string:
-  ```
-  go version | grep "go version goX.Y.Z "
-  ```
+### 5. Synchronize Go modules
 
-- **`.pyroscope.yaml`**: Update the Go source code ref for symbol resolution:
-  ```yaml
-  ref: goX.Y.Z
-  ```
+```bash
+make go/mod
+```
 
-- **`tools/update_examples.Dockerfile`**: Update the `GO_VERSION` ARG:
-  ```
-  ARG GO_VERSION=X.Y.Z
-  ```
+This runs `go work sync` and `go mod tidy` across all modules. Required because CI runs `check/go/mod`.
 
-### 7. Synchronize Go modules
+Review the diff. Expected: `go.sum` changes, small indirect dependency bumps. Investigate anything unexpected.
 
-Run the project's standard module sync target:
+### 6. Verify the build
 
 ```bash
-make go/mod
+make go/bin
 ```
 
-This runs `go work sync` and `go mod tidy` across all modules in the correct order. It is **required** because:
-- CI runs `check/go/mod` which verifies modules are tidy — skipping this will fail CI
-- Bumping the `go` directive changes the `go.sum` checksum retention window
-- Minor version bumps may cause small, legitimate dependency adjustments (e.g. transitive minimum versions)
+If the build fails, investigate and fix before proceeding.
 
-Review the resulting diff. Expected changes:
-- `go.sum` additions/removals (checksum window shift) — **normal**
-- Small indirect dependency version bumps in `go.mod` files — **normal for minor bumps**
-- Large unexpected dependency changes — **investigate before committing**
+### 7. Commit remaining changes
 
-### 8. Verify the build
+The script already committed CI/Dockerfile/release changes. Now commit the go.mod/go.work/go.sum changes:
 
 ```bash
-make go/bin
+git add -u *.mod *.sum *.work api/ lidia/ examples/
 ```
 
-If the build fails, investigate and fix before proceeding.
+Use a commit message that reflects what changed:
+- Toolchain only: `"Update Go toolchain to goX.Y.Z"`
+- Toolchain + go directive: `"Update Go to X.Y.Z (go directive + toolchain)"`
 
-### 9. Summary
+### 8. Summary
 
-After all changes, show the user:
+Show the user:
 - Number of files modified
-- Old version -> New version for each category (go directive, toolchain, CI, Dockerfiles)
+- Old -> New version for each category (go directive, toolchain, CI, Dockerfiles)
 - Whether it was a minor or patch bump
 - Build verification result
-- Summary of `make go/mod` changes (any dependency adjustments)
+- Remind user to review commits and push when ready
 
 ## Version semantics reference
 
 | Directive | Meaning | When to update |
 |-----------|---------|---------------|
-| `go X.Y.0` | Minimum Go version for compatibility | Minor bumps only |
+| `go X.Y.Z` | Minimum Go version for compatibility | Only when a dependency or language feature requires it |
 | `toolchain goX.Y.Z` | Exact build version (bug fixes, security) | Every bump (patch and minor) |
-| CI `go-version` | Exact version CI uses to build/test | Every bump |
-| Dockerfile `golang:X.Y.Z` | Exact version for container builds | Every bump |
-
-## Files Reference
-
-| Category | Files | What changes |
-|----------|-------|-------------|
-| Go modules | `go.mod`, `api/go.mod`, `lidia/go.mod`, `examples/**/go.mod` | `go` directive (minor bump) + `toolchain` directive (always) |
-| Go workspaces | `go.work`, `examples/**/go.work` | `go` directive (minor bump) + `toolchain` directive (root only) |
-| CI workflows | `.github/workflows/*.yml` | `go-version:` value |
-| Dockerfiles | `examples/**/Dockerfile*` (Go ones only) | `FROM golang:` base image tag |
-| Release | `.goreleaser.yaml` | Version check hook |
-| Profiling | `.pyroscope.yaml` | `ref:` for Go stdlib source linking |
-| Build tools | `tools/update_examples.Dockerfile` | `GO_VERSION` ARG |
+| CI `go-version` | Exact version CI uses to build/test | Every bump (via script) |
+| Dockerfile `golang:X.Y.Z` | Exact version for container builds | Every bump (via script) |

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - name: Format
         run: make fmt check/unstaged-changes
   check-generated:
@@ -40,7 +40,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - name: Check generated files
         run: make generate check/unstaged-changes
   test:
@@ -63,7 +63,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - name: Go Mod
         run: make check/go/mod
       - name: Test
@@ -78,7 +78,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - name: Run linter
         run: make lint
       - name: Check helm manifests
@@ -109,7 +109,7 @@ jobs:
       - name: Set up go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
@@ -139,7 +139,7 @@ jobs:
       - name: Set up go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       # login to docker hub
       - id: get-secrets
         uses: grafana/shared-workflows/actions/get-vault-secrets@c2f1df59dba624b3fd509e5181aa8da5217120c0

.github/workflows/fuzzer.yml

@@ -16,6 +16,6 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - name: Run Fuzz_Merge_Single
         run: go test -fuzz=Fuzz_Merge_Single --fuzztime 1h -run '^$' -v ./pkg/pprof/

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       - run: git fetch --force --tags
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.7"
           cache: false
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:

.github/workflows/test-examples.yml

@@ -22,6 +22,6 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - name: Run tests
         run: make examples/test

.github/workflows/update-contributors.yml

@@ -47,7 +47,7 @@ jobs:
           echo "user-id=$(gh api "/users/${APP_BOT}" --jq .id)" >> "$GITHUB_OUTPUT"
       - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
         with:
-          go-version: 1.24.13
+          go-version: 1.25.7
       - name: Update contributors
         run: make update-contributors
 

.github/workflows/weekly-release.yml

@@ -39,7 +39,7 @@ jobs:
           git tag "$IMAGE_TAG"
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.7"
           cache: false
       # setup docker buildx
       - name: Set up QEMU

.goreleaser.yaml

@@ -3,7 +3,7 @@ version: 2
 before:
   hooks:
     # This hook ensures that goreleaser uses the correct go version for a Pyroscope release
-    - sh -euc 'go version | grep "go version go1.24.13 " || { echo "Unexpected go version"; exit 1; }'
+    - sh -euc 'go version | grep "go version go1.25.7 " || { echo "Unexpected go version"; exit 1; }'
 env:
   # Strip debug information from the binary by default, weekly builds will have debug information
   - GORELEASER_DEBUG_INFO_FLAGS={{ if and (index .Env "GORELEASER_STRIP_DEBUG_INFO") (eq .Env.GORELEASER_STRIP_DEBUG_INFO "false")  }}{{ else }}-s -w{{ end }}

.pyroscope.yaml

@@ -8,5 +8,5 @@ source_code:
        github:
         owner: golang
         repo: go
-        ref: go1.24.13
+        ref: go1.25.7
         path: src

api/go.mod

@@ -2,7 +2,7 @@ module github.com/grafana/pyroscope/api
 
 go 1.24.6
 
-toolchain go1.24.9
+toolchain go1.25.7
 
 require (
 	connectrpc.com/connect v1.19.1
@@ -22,10 +22,11 @@ require (
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	go.opentelemetry.io/otel v1.39.0 // indirect
+	go.opentelemetry.io/otel v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/sys v0.40.0 // indirect
 	golang.org/x/text v0.33.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect