From 4d2b56603e15e8cf8ec40da97db5b0cc7ae109c7 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 9 Jul 2026 07:49:53 +0000
Subject: [PATCH] build: bump Go toolchain 1.25.11 -> 1.25.12 (GO-2026-5856)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

govulncheck flags the reachable crypto/tls Encrypted Client Hello privacy
leak (GO-2026-5856), fixed in the July 2026 go1.25.12 security release —
the sast CI gate fails repo-wide until the toolchain moves. Bumps go.mod,
Makefile TOOLS_GO_TOOLCHAIN, ci.yml GO_VERSION, all 23 deploy Dockerfiles,
all 19 azure-pipelines, and the CLAUDE.md builder-image reference.

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .github/workflows/ci.yml                                  | 8 ++++----
 CLAUDE.md                                                 | 2 +-
 Makefile                                                  | 2 +-
 auth-service/deploy/Dockerfile                            | 2 +-
 auth-service/deploy/azure-pipelines.yml                   | 2 +-
 broadcast-worker/deploy/Dockerfile                        | 2 +-
 broadcast-worker/deploy/azure-pipelines.yml               | 2 +-
 .../oplog-collections-transformer/deploy/Dockerfile       | 2 +-
 .../deploy/azure-pipelines.yml                            | 2 +-
 data-migration/oplog-connector/deploy/Dockerfile          | 2 +-
 data-migration/oplog-connector/deploy/azure-pipelines.yml | 2 +-
 data-migration/oplog-direct-transfer/deploy/Dockerfile    | 2 +-
 .../oplog-direct-transfer/deploy/azure-pipelines.yml      | 2 +-
 data-migration/oplog-transformer/deploy/Dockerfile        | 2 +-
 .../oplog-transformer/deploy/azure-pipelines.yml          | 2 +-
 go.mod                                                    | 2 +-
 history-service/deploy/Dockerfile                         | 2 +-
 history-service/deploy/azure-pipelines.yml                | 2 +-
 inbox-worker/deploy/Dockerfile                            | 2 +-
 inbox-worker/deploy/azure-pipelines.yml                   | 2 +-
 media-service/deploy/Dockerfile                           | 2 +-
 media-service/deploy/azure-pipelines.yml                  | 2 +-
 message-gatekeeper/deploy/Dockerfile                      | 2 +-
 message-gatekeeper/deploy/azure-pipelines.yml             | 2 +-
 message-worker/deploy/Dockerfile                          | 2 +-
 message-worker/deploy/azure-pipelines.yml                 | 2 +-
 notification-worker/deploy/Dockerfile                     | 2 +-
 notification-worker/deploy/azure-pipelines.yml            | 2 +-
 portal-service/deploy/Dockerfile                          | 2 +-
 portal-service/deploy/azure-pipelines.yml                 | 2 +-
 room-service/deploy/Dockerfile                            | 2 +-
 room-service/deploy/azure-pipelines.yml                   | 2 +-
 room-worker/deploy/Dockerfile                             | 2 +-
 room-worker/deploy/azure-pipelines.yml                    | 2 +-
 search-service/deploy/Dockerfile                          | 2 +-
 search-sync-worker/deploy/Dockerfile                      | 2 +-
 search-sync-worker/deploy/azure-pipelines.yml             | 2 +-
 tools/loadgen/deploy/Dockerfile                           | 2 +-
 tools/nats-debug/deploy/Dockerfile                        | 2 +-
 upload-service/deploy/Dockerfile                          | 2 +-
 user-presence-service/deploy/Dockerfile                   | 2 +-
 user-presence-service/deploy/azure-pipelines.yml          | 2 +-
 user-presence-service/sync/deploy/Dockerfile              | 2 +-
 user-presence-service/sync/deploy/azure-pipelines.yml     | 2 +-
 user-service/deploy/Dockerfile                            | 2 +-
 user-service/deploy/azure-pipelines.yml                   | 2 +-
 46 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f565d896..6463981cf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,10 +58,10 @@ permissions:
   contents: read
 
 env:
-  # Bumped to 1.25.11 for the June 2026 security release (govulncheck
-  # flagged reachable net/textproto (GO-2026-5039) and crypto/x509
-  # (GO-2026-5037) stdlib advisories fixed in 1.25.11).
-  GO_VERSION: "1.25.11"
+  # Bumped to 1.25.12 for the July 2026 security release (govulncheck
+  # flagged the reachable crypto/tls ECH advisory GO-2026-5856, fixed in
+  # 1.25.12; previous bump: GO-2026-5039/GO-2026-5037 fixed in 1.25.11).
+  GO_VERSION: "1.25.12"
   GOLANGCI_LINT_VERSION: "v2.11.4"
 
 jobs:
diff --git a/CLAUDE.md b/CLAUDE.md
index 61038f6a9..5a8541bd0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -321,7 +321,7 @@ All commands are wrapped in the root Makefile. Always use `make` targets — nev
 - Always provide `envDefault` for non-critical config (port, database name, log level); never default secrets or connection strings — mark them `required`
 
 ### Docker
-- Multi-stage Dockerfiles: `golang:1.25.11-alpine` builder, `alpine:3.21` runtime
+- Multi-stage Dockerfiles: `golang:1.25.12-alpine` builder, `alpine:3.21` runtime
 - Location: `<service>/deploy/Dockerfile`
 - Build context: repo root so `pkg/` and `go.mod` are accessible
 - Docker Compose for local dev only — include only the dependencies the service needs
diff --git a/Makefile b/Makefile
index 61a19874a..2490a2a88 100644
--- a/Makefile
+++ b/Makefile
@@ -24,7 +24,7 @@ OBS_COMPOSE      := tools/observability/docker-compose.yml
 # Go 1.25. Tracks the repo-wide Go (go.mod / ci.yml); Go fetches the
 # pinned toolchain on demand.
 GOBIN_DIR             := $(shell go env GOPATH)/bin
-TOOLS_GO_TOOLCHAIN    := go1.25.11
+TOOLS_GO_TOOLCHAIN    := go1.25.12
 GOLANGCI_LINT_VERSION := v2.11.4
 GOSEC_VERSION         := v2.26.1
 GOVULNCHECK_VERSION   := v1.3.0
diff --git a/auth-service/deploy/Dockerfile b/auth-service/deploy/Dockerfile
index 85722fbcd..f4efaf062 100644
--- a/auth-service/deploy/Dockerfile
+++ b/auth-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/auth-service/deploy/azure-pipelines.yml b/auth-service/deploy/azure-pipelines.yml
index ec5f8d9d4..7f44b250f 100644
--- a/auth-service/deploy/azure-pipelines.yml
+++ b/auth-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: auth-service
   REGISTRY: '$(containerRegistry)'
 
diff --git a/broadcast-worker/deploy/Dockerfile b/broadcast-worker/deploy/Dockerfile
index 3c00565f0..234decc2a 100644
--- a/broadcast-worker/deploy/Dockerfile
+++ b/broadcast-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/broadcast-worker/deploy/azure-pipelines.yml b/broadcast-worker/deploy/azure-pipelines.yml
index 5bf9554e9..edb175f81 100644
--- a/broadcast-worker/deploy/azure-pipelines.yml
+++ b/broadcast-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: broadcast-worker
   REGISTRY: '$(containerRegistry)'
 
diff --git a/data-migration/oplog-collections-transformer/deploy/Dockerfile b/data-migration/oplog-collections-transformer/deploy/Dockerfile
index 18b9af60c..aa611390f 100644
--- a/data-migration/oplog-collections-transformer/deploy/Dockerfile
+++ b/data-migration/oplog-collections-transformer/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/data-migration/oplog-collections-transformer/deploy/azure-pipelines.yml b/data-migration/oplog-collections-transformer/deploy/azure-pipelines.yml
index e210eb31e..ec9be76b8 100644
--- a/data-migration/oplog-collections-transformer/deploy/azure-pipelines.yml
+++ b/data-migration/oplog-collections-transformer/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-collections-transformer
   IMAGE_NAME: oplog-collections-transformer
   REGISTRY: '$(containerRegistry)'
diff --git a/data-migration/oplog-connector/deploy/Dockerfile b/data-migration/oplog-connector/deploy/Dockerfile
index 8c93bebfb..3d84d59d1 100644
--- a/data-migration/oplog-connector/deploy/Dockerfile
+++ b/data-migration/oplog-connector/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/data-migration/oplog-connector/deploy/azure-pipelines.yml b/data-migration/oplog-connector/deploy/azure-pipelines.yml
index 6c4355c3c..0f4e86180 100644
--- a/data-migration/oplog-connector/deploy/azure-pipelines.yml
+++ b/data-migration/oplog-connector/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-connector
   IMAGE_NAME: oplog-connector
   REGISTRY: '$(containerRegistry)'
diff --git a/data-migration/oplog-direct-transfer/deploy/Dockerfile b/data-migration/oplog-direct-transfer/deploy/Dockerfile
index d15d023c1..81a3946fb 100644
--- a/data-migration/oplog-direct-transfer/deploy/Dockerfile
+++ b/data-migration/oplog-direct-transfer/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/data-migration/oplog-direct-transfer/deploy/azure-pipelines.yml b/data-migration/oplog-direct-transfer/deploy/azure-pipelines.yml
index f2a5d2590..0014a98b6 100644
--- a/data-migration/oplog-direct-transfer/deploy/azure-pipelines.yml
+++ b/data-migration/oplog-direct-transfer/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-direct-transfer
   IMAGE_NAME: oplog-direct-transfer
   REGISTRY: '$(containerRegistry)'
diff --git a/data-migration/oplog-transformer/deploy/Dockerfile b/data-migration/oplog-transformer/deploy/Dockerfile
index 82dcc2cdd..ca774f835 100644
--- a/data-migration/oplog-transformer/deploy/Dockerfile
+++ b/data-migration/oplog-transformer/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/data-migration/oplog-transformer/deploy/azure-pipelines.yml b/data-migration/oplog-transformer/deploy/azure-pipelines.yml
index 473feed11..bfdfcd3bc 100644
--- a/data-migration/oplog-transformer/deploy/azure-pipelines.yml
+++ b/data-migration/oplog-transformer/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-transformer
   IMAGE_NAME: oplog-transformer
   REGISTRY: '$(containerRegistry)'
diff --git a/go.mod b/go.mod
index d213912c3..008ceb1e6 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/hmchangw/chat
 
-go 1.25.11
+go 1.25.12
 
 require (
 	github.com/Marz32onE/instrumentation-go/otel-nats v0.2.0
diff --git a/history-service/deploy/Dockerfile b/history-service/deploy/Dockerfile
index 46280b883..2b5362366 100644
--- a/history-service/deploy/Dockerfile
+++ b/history-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/history-service/deploy/azure-pipelines.yml b/history-service/deploy/azure-pipelines.yml
index 99bd43eba..4e15d0b4b 100644
--- a/history-service/deploy/azure-pipelines.yml
+++ b/history-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: history-service
   REGISTRY: '$(containerRegistry)'
 
diff --git a/inbox-worker/deploy/Dockerfile b/inbox-worker/deploy/Dockerfile
index 42577f069..5bd4f9b23 100644
--- a/inbox-worker/deploy/Dockerfile
+++ b/inbox-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/inbox-worker/deploy/azure-pipelines.yml b/inbox-worker/deploy/azure-pipelines.yml
index 905dadfc4..f6118a6e5 100644
--- a/inbox-worker/deploy/azure-pipelines.yml
+++ b/inbox-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: inbox-worker
   REGISTRY: '$(containerRegistry)'
 
diff --git a/media-service/deploy/Dockerfile b/media-service/deploy/Dockerfile
index 3c55725dc..476fa65d1 100644
--- a/media-service/deploy/Dockerfile
+++ b/media-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/media-service/deploy/azure-pipelines.yml b/media-service/deploy/azure-pipelines.yml
index 19a4d20a1..c42373710 100644
--- a/media-service/deploy/azure-pipelines.yml
+++ b/media-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: media-service
   REGISTRY: '$(containerRegistry)'
 
diff --git a/message-gatekeeper/deploy/Dockerfile b/message-gatekeeper/deploy/Dockerfile
index dee83caf7..59a20f1de 100644
--- a/message-gatekeeper/deploy/Dockerfile
+++ b/message-gatekeeper/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/message-gatekeeper/deploy/azure-pipelines.yml b/message-gatekeeper/deploy/azure-pipelines.yml
index 8829ec41b..39387a32f 100644
--- a/message-gatekeeper/deploy/azure-pipelines.yml
+++ b/message-gatekeeper/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: message-gatekeeper
   REGISTRY: '$(containerRegistry)'
 
diff --git a/message-worker/deploy/Dockerfile b/message-worker/deploy/Dockerfile
index 2cf78c01d..2b95488f5 100644
--- a/message-worker/deploy/Dockerfile
+++ b/message-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/message-worker/deploy/azure-pipelines.yml b/message-worker/deploy/azure-pipelines.yml
index 0de3f0082..a6928df66 100644
--- a/message-worker/deploy/azure-pipelines.yml
+++ b/message-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: message-worker
   REGISTRY: '$(containerRegistry)'
 
diff --git a/notification-worker/deploy/Dockerfile b/notification-worker/deploy/Dockerfile
index 6b5737078..112cc1a36 100644
--- a/notification-worker/deploy/Dockerfile
+++ b/notification-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/notification-worker/deploy/azure-pipelines.yml b/notification-worker/deploy/azure-pipelines.yml
index 8d6c3f9db..34ff1b12a 100644
--- a/notification-worker/deploy/azure-pipelines.yml
+++ b/notification-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: notification-worker
   REGISTRY: '$(containerRegistry)'
 
diff --git a/portal-service/deploy/Dockerfile b/portal-service/deploy/Dockerfile
index f82336716..7a3ab4e8c 100644
--- a/portal-service/deploy/Dockerfile
+++ b/portal-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/portal-service/deploy/azure-pipelines.yml b/portal-service/deploy/azure-pipelines.yml
index 57b5e5a03..acf8e71ab 100644
--- a/portal-service/deploy/azure-pipelines.yml
+++ b/portal-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: portal-service
   REGISTRY: '$(containerRegistry)'
   # Repo-wide 80% minimum, gated like search-service's pipeline. main.go is
diff --git a/room-service/deploy/Dockerfile b/room-service/deploy/Dockerfile
index be3c53232..9e53c5532 100644
--- a/room-service/deploy/Dockerfile
+++ b/room-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/room-service/deploy/azure-pipelines.yml b/room-service/deploy/azure-pipelines.yml
index 42c285caf..3548385f0 100644
--- a/room-service/deploy/azure-pipelines.yml
+++ b/room-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: room-service
   REGISTRY: '$(containerRegistry)'
 
diff --git a/room-worker/deploy/Dockerfile b/room-worker/deploy/Dockerfile
index 8062ccaa4..593ec31a6 100644
--- a/room-worker/deploy/Dockerfile
+++ b/room-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/room-worker/deploy/azure-pipelines.yml b/room-worker/deploy/azure-pipelines.yml
index c57b25c1f..b86338b28 100644
--- a/room-worker/deploy/azure-pipelines.yml
+++ b/room-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: room-worker
   REGISTRY: '$(containerRegistry)'
 
diff --git a/search-service/deploy/Dockerfile b/search-service/deploy/Dockerfile
index 727df3f3b..6acd788b8 100644
--- a/search-service/deploy/Dockerfile
+++ b/search-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/search-sync-worker/deploy/Dockerfile b/search-sync-worker/deploy/Dockerfile
index 7d6fdb28e..34c147f0b 100644
--- a/search-sync-worker/deploy/Dockerfile
+++ b/search-sync-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/search-sync-worker/deploy/azure-pipelines.yml b/search-sync-worker/deploy/azure-pipelines.yml
index 8aa77c10e..e9445adb4 100644
--- a/search-sync-worker/deploy/azure-pipelines.yml
+++ b/search-sync-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: search-sync-worker
   REGISTRY: '$(containerRegistry)'
 
diff --git a/tools/loadgen/deploy/Dockerfile b/tools/loadgen/deploy/Dockerfile
index 8a9d80b12..d1902bbbe 100644
--- a/tools/loadgen/deploy/Dockerfile
+++ b/tools/loadgen/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 
diff --git a/tools/nats-debug/deploy/Dockerfile b/tools/nats-debug/deploy/Dockerfile
index feec9a9bf..f51cd6ee3 100644
--- a/tools/nats-debug/deploy/Dockerfile
+++ b/tools/nats-debug/deploy/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # ── Build stage ───────────────────────────────────────────────────────────────
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /build
 
diff --git a/upload-service/deploy/Dockerfile b/upload-service/deploy/Dockerfile
index 3e7b77c8a..7e3b58fd7 100644
--- a/upload-service/deploy/Dockerfile
+++ b/upload-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/user-presence-service/deploy/Dockerfile b/user-presence-service/deploy/Dockerfile
index d9543c6a1..2f05238f3 100644
--- a/user-presence-service/deploy/Dockerfile
+++ b/user-presence-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/user-presence-service/deploy/azure-pipelines.yml b/user-presence-service/deploy/azure-pipelines.yml
index fb2b0e37b..52a830ddc 100644
--- a/user-presence-service/deploy/azure-pipelines.yml
+++ b/user-presence-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: user-presence-service
   REGISTRY: '$(containerRegistry)'
 
diff --git a/user-presence-service/sync/deploy/Dockerfile b/user-presence-service/sync/deploy/Dockerfile
index 1f414a6f6..aab55c168 100644
--- a/user-presence-service/sync/deploy/Dockerfile
+++ b/user-presence-service/sync/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/user-presence-service/sync/deploy/azure-pipelines.yml b/user-presence-service/sync/deploy/azure-pipelines.yml
index a5b642441..2592317d5 100644
--- a/user-presence-service/sync/deploy/azure-pipelines.yml
+++ b/user-presence-service/sync/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_DIR: user-presence-service/sync
   IMAGE_NAME: user-presence-sync
   REGISTRY: '$(containerRegistry)'
diff --git a/user-service/deploy/Dockerfile b/user-service/deploy/Dockerfile
index 3a90d5ad5..1218a795f 100644
--- a/user-service/deploy/Dockerfile
+++ b/user-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/user-service/deploy/azure-pipelines.yml b/user-service/deploy/azure-pipelines.yml
index 4bc9630c5..84c51445f 100644
--- a/user-service/deploy/azure-pipelines.yml
+++ b/user-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: user-service
   REGISTRY: '$(containerRegistry)'