[pull] trunk from cli:trunk

.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-	"image": "mcr.microsoft.com/devcontainers/go:1.24",
+	"image": "mcr.microsoft.com/devcontainers/go:1.25",
 	"features": {
 		"ghcr.io/devcontainers/features/sshd:1": {}
 	},

.github/CONTRIBUTING.md

@@ -24,7 +24,7 @@ We accept pull requests for bug fixes and features where we've discussed the app
 ## Building the project
 
 Prerequisites:
-- Go 1.24+
+- Go 1.25+
 
 Build with:
 * Unix-like systems: `make`

.github/workflows/govulncheck.yml

@@ -2,6 +2,8 @@ name: Go Vulnerability Check
 on:
   schedule:
     - cron: "0 0 * * 1" # Every Monday at midnight UTC
+  workflow_dispatch:
+
 jobs:
   govulncheck:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -60,7 +60,9 @@ jobs:
 
       # `govulncheck` exits unsuccessfully if vulnerabilities are found, providing results in stdout.
       # See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck#hdr-Exit_codes for more information on exit codes.
+      #
+      # On go1.25, To make `-mode binary` work we need to make sure the binary is built with `go build -buildvcs=false`
+      # Since our builds do not use `-buildvcs=false`, we run in source mode here instead.
       - name: Check Go vulnerabilities
         run: |
-          make
-          go run golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 -mode=binary bin/gh
+          go run golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 ./...

docs/install_source.md

@@ -1,6 +1,6 @@
 # Installation from source
 
-1. Verify that you have Go 1.24+ installed
+1. Verify that you have Go 1.25+ installed
 
    ```sh
    $ go version

docs/source.md

@@ -1,6 +1,6 @@
 # Installation from source
 
-1. Verify that you have Go 1.24+ installed
+1. Verify that you have Go 1.25+ installed
 
    ```sh
    $ go version

go.mod

@@ -1,8 +1,8 @@
 module github.com/cli/cli/v2
 
-go 1.24.0
+go 1.25.0
 
-toolchain go1.24.9
+toolchain go1.25.3
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7

internal/ghinstance/host.go

@@ -26,7 +26,7 @@ func Default() string {
 // reports whether it found the tenant name.
 func TenantName(h string) (string, bool) {
 	normalizedHostName := ghauth.NormalizeHostname(h)
-	return cutSuffix(normalizedHostName, "."+tenancyHost)
+	return strings.CutSuffix(normalizedHostName, "."+tenancyHost)
 }
 
 func isGarage(h string) bool {
@@ -96,11 +96,3 @@ func HostPrefix(hostname string) string {
 	}
 	return fmt.Sprintf("https://%s/", hostname)
 }
-
-// Backport strings.CutSuffix from Go 1.20.
-func cutSuffix(s, suffix string) (string, bool) {
-	if !strings.HasSuffix(s, suffix) {
-		return s, false
-	}
-	return s[:len(s)-len(suffix)], true
-}