build(deps): bump go to 1.25.13 (#12832)

Author: 2403905

.github/workflows/release.yml

@@ -16,7 +16,7 @@ on:
 env:
   NODE_VERSION: '24'
   PNPM_VERSION: '10.28.1'
-  GOLANG_BUILD_IMAGE: 'golang:1.25.12-alpine3.23@sha256:cc985ef6f9c3bf9ece7488129c9abe0a150388ccdfa428d886fc709dca0b230a'
+  GOLANG_BUILD_IMAGE: 'golang:1.25.13-alpine3.23@sha256:42fc3368d1c50170a452f2bf4a1dfd292a065870c3f258d799aad4316671cb69'
 
 jobs:
   determine-release-type:

CHANGELOG.md

@@ -76,6 +76,7 @@ The following sections list the changes for 8.0.8.
 ## Summary
 
 * Security - Bump golang.org/x/image to v0.45.0: [#12808](https://github.com/owncloud/ocis/pull/12808)
+* Security - Bump Go to 1.25.13: [#12832](https://github.com/owncloud/ocis/pull/12832)
 * Bugfix - Cache LDAP instance mapper lookups: [#12823](https://github.com/owncloud/ocis/pull/12823)
 * Bugfix - Fix share metadata corruption during concurrent share operations: [#12621](https://github.com/owncloud/ocis/pull/12621)
 * Enhancement - Add TLS support for NATS store and registry connections: [#12765](https://github.com/owncloud/ocis/pull/12765)
@@ -89,6 +90,12 @@ The following sections list the changes for 8.0.8.
 
    https://github.com/owncloud/ocis/pull/12808
 
+* Security - Bump Go to 1.25.13: [#12832](https://github.com/owncloud/ocis/pull/12832)
+
+   Fixes a stdlib CVE vulnerability flagged by the release image scan.
+
+   https://github.com/owncloud/ocis/pull/12832
+
 * Bugfix - Cache LDAP instance mapper lookups: [#12823](https://github.com/owncloud/ocis/pull/12823)
 
    In multi-instance deployments, resolving a user's instance name/ID during

changelog/8.0.8_2026-08-20/security-bump-go-1.25.13.md

@@ -0,0 +1,5 @@
+Security: Bump Go to 1.25.13
+
+Fixes a stdlib CVE vulnerability flagged by the release image scan.
+
+https://github.com/owncloud/ocis/pull/12832

go.mod

@@ -1,6 +1,6 @@
 module github.com/owncloud/ocis/v2
 
-go 1.25.12
+go 1.25.13
 
 require (
 	dario.cat/mergo v1.0.2