hmchangw · general-lex · Jul 9, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -58,10 +58,10 @@ permissions:
   contents: read
 
 env:
-  # Bumped to 1.25.11 for the June 2026 security release (govulncheck
-  # flagged reachable net/textproto (GO-2026-5039) and crypto/x509
-  # (GO-2026-5037) stdlib advisories fixed in 1.25.11).
-  GO_VERSION: "1.25.11"
+  # Bumped to 1.25.12 for the July 2026 security release (govulncheck
+  # flagged the reachable crypto/tls ECH advisory GO-2026-5856, fixed in
+  # 1.25.12; previous bump: GO-2026-5039/GO-2026-5037 fixed in 1.25.11).
+  GO_VERSION: "1.25.12"
   GOLANGCI_LINT_VERSION: "v2.11.4"
 
 jobs:

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -321,7 +321,7 @@ All commands are wrapped in the root Makefile. Always use `make` targets — nev
 - Always provide `envDefault` for non-critical config (port, database name, log level); never default secrets or connection strings — mark them `required`
 
 ### Docker
-- Multi-stage Dockerfiles: `golang:1.25.11-alpine` builder, `alpine:3.21` runtime
+- Multi-stage Dockerfiles: `golang:1.25.12-alpine` builder, `alpine:3.21` runtime
 - Location: `<service>/deploy/Dockerfile`
 - Build context: repo root so `pkg/` and `go.mod` are accessible
 - Docker Compose for local dev only — include only the dependencies the service needs

diff --git a/Makefile b/Makefile
@@ -24,7 +24,7 @@ OBS_COMPOSE      := tools/observability/docker-compose.yml
 # Go 1.25. Tracks the repo-wide Go (go.mod / ci.yml); Go fetches the
 # pinned toolchain on demand.
 GOBIN_DIR             := $(shell go env GOPATH)/bin
-TOOLS_GO_TOOLCHAIN    := go1.25.11
+TOOLS_GO_TOOLCHAIN    := go1.25.12
 GOLANGCI_LINT_VERSION := v2.11.4
 GOSEC_VERSION         := v2.26.1
 GOVULNCHECK_VERSION   := v1.3.0

diff --git a/auth-service/deploy/Dockerfile b/auth-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/auth-service/deploy/azure-pipelines.yml b/auth-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: auth-service
   REGISTRY: '$(containerRegistry)'
 

diff --git a/broadcast-worker/deploy/Dockerfile b/broadcast-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/broadcast-worker/deploy/azure-pipelines.yml b/broadcast-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: broadcast-worker
   REGISTRY: '$(containerRegistry)'
 

diff --git a/data-migration/oplog-collections-transformer/deploy/Dockerfile b/data-migration/oplog-collections-transformer/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/data-migration/oplog-collections-transformer/deploy/azure-pipelines.yml b/data-migration/oplog-collections-transformer/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-collections-transformer
   IMAGE_NAME: oplog-collections-transformer
   REGISTRY: '$(containerRegistry)'

diff --git a/data-migration/oplog-connector/deploy/Dockerfile b/data-migration/oplog-connector/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/data-migration/oplog-connector/deploy/azure-pipelines.yml b/data-migration/oplog-connector/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-connector
   IMAGE_NAME: oplog-connector
   REGISTRY: '$(containerRegistry)'

diff --git a/data-migration/oplog-direct-transfer/deploy/Dockerfile b/data-migration/oplog-direct-transfer/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/data-migration/oplog-direct-transfer/deploy/azure-pipelines.yml b/data-migration/oplog-direct-transfer/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-direct-transfer
   IMAGE_NAME: oplog-direct-transfer
   REGISTRY: '$(containerRegistry)'

diff --git a/data-migration/oplog-transformer/deploy/Dockerfile b/data-migration/oplog-transformer/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/data-migration/oplog-transformer/deploy/azure-pipelines.yml b/data-migration/oplog-transformer/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_PATH: data-migration/oplog-transformer
   IMAGE_NAME: oplog-transformer
   REGISTRY: '$(containerRegistry)'

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/hmchangw/chat
 
-go 1.25.11
+go 1.25.12
 
 require (
 	github.com/Marz32onE/instrumentation-go/otel-nats v0.2.0

diff --git a/history-service/deploy/Dockerfile b/history-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/history-service/deploy/azure-pipelines.yml b/history-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: history-service
   REGISTRY: '$(containerRegistry)'
 

diff --git a/inbox-worker/deploy/Dockerfile b/inbox-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/inbox-worker/deploy/azure-pipelines.yml b/inbox-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: inbox-worker
   REGISTRY: '$(containerRegistry)'
 

diff --git a/media-service/deploy/Dockerfile b/media-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/media-service/deploy/azure-pipelines.yml b/media-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: media-service
   REGISTRY: '$(containerRegistry)'
 

diff --git a/message-gatekeeper/deploy/Dockerfile b/message-gatekeeper/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/message-gatekeeper/deploy/azure-pipelines.yml b/message-gatekeeper/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: message-gatekeeper
   REGISTRY: '$(containerRegistry)'
 

diff --git a/message-worker/deploy/Dockerfile b/message-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/message-worker/deploy/azure-pipelines.yml b/message-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: message-worker
   REGISTRY: '$(containerRegistry)'
 

diff --git a/notification-worker/deploy/Dockerfile b/notification-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/notification-worker/deploy/azure-pipelines.yml b/notification-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: notification-worker
   REGISTRY: '$(containerRegistry)'
 

diff --git a/portal-service/deploy/Dockerfile b/portal-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/portal-service/deploy/azure-pipelines.yml b/portal-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: portal-service
   REGISTRY: '$(containerRegistry)'
   # Repo-wide 80% minimum, gated like search-service's pipeline. main.go is

diff --git a/room-service/deploy/Dockerfile b/room-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/room-service/deploy/azure-pipelines.yml b/room-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: room-service
   REGISTRY: '$(containerRegistry)'
 

diff --git a/room-worker/deploy/Dockerfile b/room-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/room-worker/deploy/azure-pipelines.yml b/room-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: room-worker
   REGISTRY: '$(containerRegistry)'
 

diff --git a/search-service/deploy/Dockerfile b/search-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/search-sync-worker/deploy/Dockerfile b/search-sync-worker/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/search-sync-worker/deploy/azure-pipelines.yml b/search-sync-worker/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: search-sync-worker
   REGISTRY: '$(containerRegistry)'
 

diff --git a/tools/loadgen/deploy/Dockerfile b/tools/loadgen/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /app
 

diff --git a/tools/nats-debug/deploy/Dockerfile b/tools/nats-debug/deploy/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # ── Build stage ───────────────────────────────────────────────────────────────
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 
 WORKDIR /build
 

diff --git a/upload-service/deploy/Dockerfile b/upload-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/user-presence-service/deploy/Dockerfile b/user-presence-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/user-presence-service/deploy/azure-pipelines.yml b/user-presence-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: user-presence-service
   REGISTRY: '$(containerRegistry)'
 

diff --git a/user-presence-service/sync/deploy/Dockerfile b/user-presence-service/sync/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/user-presence-service/sync/deploy/azure-pipelines.yml b/user-presence-service/sync/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_DIR: user-presence-service/sync
   IMAGE_NAME: user-presence-sync
   REGISTRY: '$(containerRegistry)'

diff --git a/user-service/deploy/Dockerfile b/user-service/deploy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25.11-alpine AS builder
+FROM golang:1.25.12-alpine AS builder
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

diff --git a/user-service/deploy/azure-pipelines.yml b/user-service/deploy/azure-pipelines.yml
@@ -18,7 +18,7 @@ pr:
       - pkg/
 
 variables:
-  GO_VERSION: '1.25.11'
+  GO_VERSION: '1.25.12'
   SERVICE_NAME: user-service
   REGISTRY: '$(containerRegistry)'