GHO-11515 chore: bump go toolchain to 1.25.9 to clear stdlib CVEs

cmd/benchmark/main.go

@@ -178,7 +178,7 @@ func benchmarkEngine(engineType string, rules []poltergeist.Rule, benchmarkDir s
 	default:
 		log.Fatalf("Unknown engine type: %s", engineType)
 	}
-	defer engine.Close()
+	defer func() { _ = engine.Close() }()
 
 	// Measure compilation time
 	compileStart := time.Now()
@@ -289,10 +289,11 @@ func printSummaryTable(results []BenchmarkResult) {
 
 		for _, result := range group {
 			totalTime := result.CompileDuration + result.ScanDuration
-			if result.Engine == "go" {
+			switch result.Engine {
+			case "go":
 				goTime = totalTime
 				hasGo = true
-			} else if result.Engine == "hyperscan" {
+			case "hyperscan":
 				hsTime = totalTime
 				hasHS = true
 			}

cmd/poltergeist/main.go

@@ -152,7 +152,7 @@ func main() {
 	}
 
 	// Ensure engine cleanup
-	defer engine.Close()
+	defer func() { _ = engine.Close() }()
 
 	// Create scanner with optimized settings
 	scanner := poltergeist.NewScannerWithOptions(engine, runtime.NumCPU()*2, 100*1024*1024)

examples/simple_library_usage.go

@@ -40,7 +40,7 @@ func main() {
 	} else {
 		engine = poltergeist.NewGoRegexEngine()
 	}
-	defer engine.Close()
+	defer func() { _ = engine.Close() }()
 
 	// Compile rules
 	err = engine.CompileRules(rules)

go.mod

@@ -1,6 +1,6 @@
 module github.com/ghostsecurity/poltergeist/v2
 
-go 1.25.6
+go 1.25.9
 
 require github.com/flier/gohs v1.2.3
 

pkg/engine_test.go

@@ -18,7 +18,7 @@ func TestEngineCompilationErrors(t *testing.T) {
 
 	// Test Go regex engine with invalid pattern
 	goEngine := NewGoRegexEngine()
-	defer goEngine.Close()
+	defer func() { _ = goEngine.Close() }()
 
 	err := goEngine.CompileRules(invalidRules)
 	if err == nil {
@@ -28,7 +28,7 @@ func TestEngineCompilationErrors(t *testing.T) {
 	// Test Hyperscan engine with invalid pattern (if available)
 	if IsHyperscanAvailable() {
 		hsEngine := NewHyperscanEngine()
-		defer hsEngine.Close()
+		defer func() { _ = hsEngine.Close() }()
 
 		err = hsEngine.CompileRules(invalidRules)
 		if err == nil {
@@ -53,7 +53,7 @@ func TestEngineRedaction(t *testing.T) {
 	}
 
 	for _, engine := range engines {
-		defer engine.Close()
+		defer func() { _ = engine.Close() }()
 
 		err := engine.CompileRules(redactionRule)
 		if err != nil {
@@ -96,7 +96,7 @@ func TestEngineRedactionAlwaysRedacts(t *testing.T) {
 	}
 
 	for _, engine := range engines {
-		defer engine.Close()
+		defer func() { _ = engine.Close() }()
 
 		err := engine.CompileRules(redactionRule)
 		if err != nil {

pkg/poltergeist.go

@@ -158,7 +158,7 @@ func LoadRules(path string) ([]Rule, error) {
 func IsHyperscanAvailable() bool {
 	// Try to create a hyperscan engine and test compilation
 	engine := NewHyperscanEngine()
-	defer engine.Close()
+	defer func() { _ = engine.Close() }()
 
 	// Test with a simple rule
 	testRule := []Rule{{Name: "test", ID: "test.1", Pattern: "test", Tags: []string{"test"}, Entropy: 1.0}}
@@ -321,7 +321,7 @@ func (s *Scanner) scanFile(filePath string) ([]ScanResult, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	var results []ScanResult
 	scanner := bufio.NewScanner(file)
@@ -475,7 +475,7 @@ func isBinaryFile(filePath string) bool {
 	if err != nil {
 		return true // Assume binary if we can't read it
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 
 	// Read first 512 bytes (standard for file type detection)
 	buffer := make([]byte, 512)

pkg/rule_test.go

@@ -115,7 +115,7 @@ func validateRule(t *testing.T, rule Rule, seenIDs map[string]bool) {
 	// Create a per-test hyperscan engine for thread safety
 	hyperscanEngine := NewHyperscanEngine()
 	t.Cleanup(func() {
-		hyperscanEngine.Close()
+		_ = hyperscanEngine.Close()
 	})
 
 	// Rule pattern must compile with Hyperscan regex engine