diff --git a/Windows.Dockerfile b/Windows.Dockerfile
index 42862258..2e458a85 100644
--- a/Windows.Dockerfile
+++ b/Windows.Dockerfile
@@ -18,7 +18,7 @@ RUN $newPath = ('{0}\bin;C:\go\bin;{1}' -f $env:GOPATH, $env:PATH); \
 # ideally we should be able to use FROM golang:windowsservercore-1803. This is not done due to two reasons
 # 1. The go lang for 1803 tag is not available.
 
-ENV GOLANG_VERSION 1.24.6
+ENV GOLANG_VERSION 1.25.0
 
 RUN $url = ('https://golang.org/dl/go{0}.windows-amd64.zip' -f $env:GOLANG_VERSION); \
 	Write-Host ('Downloading {0} ...' -f $url); \
diff --git a/azure-pipelines-windows.yml b/azure-pipelines-windows.yml
index 13ff1fd0..fdb5e4e6 100644
--- a/azure-pipelines-windows.yml
+++ b/azure-pipelines-windows.yml
@@ -15,7 +15,7 @@ steps:
 
 - task: GoTool@0
   inputs:
-    version: '1.24.6'
+    version: '1.25.0'
 
 - script: |
     (robocopy $(system.defaultWorkingDirectory) $(ModulePath) /E /XD  $(system.defaultWorkingDirectory)\work)^& IF %ERRORLEVEL% LSS 8 SET ERRORLEVEL = 0
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 352881a1..27c562e1 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -15,7 +15,7 @@ steps:
 
 - task: GoTool@0
   inputs:
-    version: '1.24.6'
+    version: '1.25.0'
 
 - script: |
     set -e
diff --git a/cmd/acr/purge_untagged_only_test.go b/cmd/acr/purge_untagged_only_test.go
index baf3c3b6..31f2ccbe 100644
--- a/cmd/acr/purge_untagged_only_test.go
+++ b/cmd/acr/purge_untagged_only_test.go
@@ -813,7 +813,7 @@ func TestPurgeAbacVerboseMode(t *testing.T) {
 		os.Stdout = w
 
 		// Call purge with verbose=true and ABAC enabled
-		deletedTagsCount, deletedManifestsCount, err := purge(
+		deletedTagsCount, deletedManifestsCount, purgeErr := purge(
 			testCtx,
 			mockClient,
 			testLoginURL,
@@ -830,15 +830,21 @@ func TestPurgeAbacVerboseMode(t *testing.T) {
 		)
 
 		// Restore stdout and read captured output
-		w.Close()
+		err := w.Close()
+		if err != nil {
+			t.Fatalf("Failed to close pipe writer: %v", err)
+		}
 		os.Stdout = oldStdout
 		var buf bytes.Buffer
-		io.Copy(&buf, r)
+		_, err = io.Copy(&buf, r)
+		if err != nil {
+			t.Fatalf("Failed to read from pipe: %v", err)
+		}
 		output := buf.String()
 
 		assert.Equal(0, deletedTagsCount, "No tags should be deleted")
 		assert.Equal(0, deletedManifestsCount, "No manifests deleted when none are untagged")
-		assert.Nil(err, "Error should be nil")
+		assert.Nil(purgeErr, "Error should be nil")
 		// Verify verbose output contains repository names
 		assert.Contains(output, "ABAC: Setting token scope for 3 repositories:", "Should output repo count")
 		assert.Contains(output, "repo1", "Should output repo1 in verbose mode")
@@ -883,7 +889,7 @@ func TestPurgeAbacVerboseMode(t *testing.T) {
 		os.Stdout = w
 
 		// Call purge with verbose=false and ABAC enabled
-		deletedTagsCount, deletedManifestsCount, err := purge(
+		deletedTagsCount, deletedManifestsCount, purgeErr := purge(
 			testCtx,
 			mockClient,
 			testLoginURL,
@@ -900,15 +906,21 @@ func TestPurgeAbacVerboseMode(t *testing.T) {
 		)
 
 		// Restore stdout and read captured output
-		w.Close()
+		err := w.Close()
+		if err != nil {
+			t.Fatalf("Failed to close pipe writer: %v", err)
+		}
 		os.Stdout = oldStdout
 		var buf bytes.Buffer
-		io.Copy(&buf, r)
+		_, err = io.Copy(&buf, r)
+		if err != nil {
+			t.Fatalf("Failed to read from pipe: %v", err)
+		}
 		output := buf.String()
 
 		assert.Equal(0, deletedTagsCount, "No tags should be deleted")
 		assert.Equal(0, deletedManifestsCount, "No manifests deleted when none are untagged")
-		assert.Nil(err, "Error should be nil")
+		assert.Nil(purgeErr, "Error should be nil")
 		// Verify non-verbose output contains count but NOT the repository list
 		assert.Contains(output, "ABAC: Setting token scope for 3 repositories", "Should output repo count")
 		// The non-verbose output should NOT contain the bracketed list of repos
diff --git a/go.mod b/go.mod
index e1d56a7d..602d8a9b 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/Azure/acr-cli
 
-go 1.24.6
+go 1.25.0
 
 require (
 	github.com/Azure/go-autorest/autorest v0.11.30
diff --git a/internal/api/acrsdk_test.go b/internal/api/acrsdk_test.go
index 10b0f272..3ed07cce 100644
--- a/internal/api/acrsdk_test.go
+++ b/internal/api/acrsdk_test.go
@@ -96,7 +96,7 @@ func TestGetAcrCLIClientWithAuth(t *testing.T) {
 		}
 		switch path {
 		case "/oauth2/token":
-			if err := r.ParseForm(); err != nil {
+			if err := r.ParseForm(); err != nil { //nolint:gosec // G120: test server, no risk of memory exhaustion
 				w.WriteHeader(http.StatusUnauthorized)
 				t.Fatal("unable to parse form")
 			}
@@ -263,7 +263,7 @@ func TestHasAadIdentityClaim(t *testing.T) {
 			}, "."),
 			expected: false,
 		},
-		{
+		{ //nolint:gosec // G101: not a real credential, test data
 			name:     "invalid token",
 			token:    "not-a-valid-jwt",
 			expected: false,
@@ -391,7 +391,7 @@ func TestRefreshAcrCLIClientTokenAbac(t *testing.T) {
 					w.WriteHeader(http.StatusNotFound)
 					return
 				}
-				if err := r.ParseForm(); err != nil {
+				if err := r.ParseForm(); err != nil { //nolint:gosec // G120: test server, no risk of memory exhaustion
 					w.WriteHeader(http.StatusBadRequest)
 					return
 				}
diff --git a/scripts/setup/dev_setup b/scripts/setup/dev_setup
index 7899dc4b..35fb9c4a 100755
--- a/scripts/setup/dev_setup
+++ b/scripts/setup/dev_setup
@@ -3,4 +3,4 @@
 set -e -o pipefail
 
 # binary will be $(go env GOPATH)/bin/golangci-lint
-curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.3.1
\ No newline at end of file
+curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.3
\ No newline at end of file