fix: bump to golang v1.25.8

Dockerfile

@@ -1,13 +1,13 @@
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-FROM golang:1.25.7-alpine@sha256:81d49e1de26fa223b9ae0b4d5a4065ff8176a7d80aa5ef0bd9f2eee430afe4d7 AS spicedb-builder
+FROM golang:1.25.8-alpine@sha256:8e02eb337d9e0ea459e041f1ee5eece41cbb61f1d83e7d883a3e2fb4862063fa AS spicedb-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git
 COPY . .
 # https://github.com/odigos-io/go-rtml#about-ldflags-checklinkname0
 RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -tags memoryprotection -v -ldflags=-checklinkname=0 -o spicedb ./cmd/spicedb
 
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
-FROM golang:1.25.7-alpine@sha256:81d49e1de26fa223b9ae0b4d5a4065ff8176a7d80aa5ef0bd9f2eee430afe4d7 AS health-probe-builder
+FROM golang:1.25.8-alpine@sha256:8e02eb337d9e0ea459e041f1ee5eece41cbb61f1d83e7d883a3e2fb4862063fa AS health-probe-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git
 RUN git clone https://github.com/authzed/grpc-health-probe.git

Dockerfile.release

@@ -1,7 +1,7 @@
 # vim: syntax=dockerfile
 # use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
 ARG BASE=cgr.dev/chainguard/static@sha256:99a5f826e71115aef9f63368120a6aa518323e052297718e9bf084fb84def93c
-FROM golang:1.25.7-alpine@sha256:81d49e1de26fa223b9ae0b4d5a4065ff8176a7d80aa5ef0bd9f2eee430afe4d7 AS health-probe-builder
+FROM golang:1.25.8-alpine@sha256:8e02eb337d9e0ea459e041f1ee5eece41cbb61f1d83e7d883a3e2fb4862063fa AS health-probe-builder
 WORKDIR /go/src/app
 RUN apk update && apk add --no-cache git
 RUN git clone https://github.com/authzed/grpc-health-probe.git

e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/authzed/spicedb/e2e
 
-go 1.25.7
+go 1.25.8
 
 replace github.com/authzed/spicedb => ../
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/authzed/spicedb
 
-go 1.25.7
+go 1.25.8
 
 // NOTE: We are using a *copy* of `cel-go` here to ensure there isn't a conflict
 // with the version used in Kubernetes. This is a temporary measure until we can

magefiles/go.mod

@@ -1,6 +1,6 @@
 module magefiles
 
-go 1.25.7
+go 1.25.8
 
 require (
 	github.com/agnivade/wasmbrowsertest v0.11.0

magefiles/test.go

@@ -41,7 +41,7 @@ func (t Test) Unit(ctx context.Context) error {
 }
 
 func (Test) unit(ctx context.Context, coverage bool) error {
-	args := []string{"-tags", "ci,skipintegrationtests,memoryprotection", "-race", "-timeout", "10m", "-count=1"}
+	args := []string{"-tags", "ci,skipintegrationtests,memoryprotection", "-race", "-timeout", "15m", "-count=1"}
 	if coverage {
 		fmt.Println("running unit tests with coverage")
 		args = append(args, coverageFlags...)

tools/analyzers/go.mod

@@ -1,6 +1,6 @@
 module github.com/authzed/spicedb/tools/analyzers
 
-go 1.25.7
+go 1.25.8
 
 require (
 	github.com/samber/lo v1.52.0

tools/analyzers/go.work

@@ -1,4 +1,4 @@
-go 1.25.7
+go 1.25.8
 
 use (
 	.