fix: upgrade Go to 1.25.12 (#12602)

fix: upgrade Go to 1.25.12 (CVE-2026-39822)

The release image Trivy scan blocks on CVE-2026-39822 in the Go stdlib
(os.Root symlink following / directory traversal, HIGH), present in the
Go 1.25.11 binary and fixed in 1.25.12.

Bump the go directive in go.mod to 1.25.12 (this drives the golang-alpine
build image the docker-build job derives from go.mod) and update the
pinned GOLANG_BUILD_IMAGE in release.yml to the matching 1.25.12 digest.

Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>

Author: kobergj

.github/workflows/release.yml

@@ -16,7 +16,7 @@ on:
 env:
   NODE_VERSION: '24'
   PNPM_VERSION: '10.28.1'
-  GOLANG_BUILD_IMAGE: 'golang:1.25.11-alpine3.23@sha256:c05ba4b73604069d376c4f41346b05374335b5ca0c46fb6dfede5a59f5196931'
+  GOLANG_BUILD_IMAGE: 'golang:1.25.12-alpine3.23@sha256:cc985ef6f9c3bf9ece7488129c9abe0a150388ccdfa428d886fc709dca0b230a'
 
 jobs:
   determine-release-type:

changelog/8.0.6_2026-07-15/security-upgrade-go-1.25.12.md

@@ -0,0 +1,8 @@
+Security: Upgrade Go to 1.25.12
+
+Bumped the Go toolchain used to build the release binaries and Docker images
+from 1.25.11 to 1.25.12. Go 1.25.11 is affected by CVE-2026-39822 (os.Root
+symlink following allows directory traversal), which is fixed in 1.25.12 and
+was blocking the release image security scan.
+
+https://github.com/owncloud/ocis/pull/12602

go.mod

@@ -1,6 +1,6 @@
 module github.com/owncloud/ocis/v2
 
-go 1.25.11
+go 1.25.12
 
 require (
 	dario.cat/mergo v1.0.2