From ed6b0cc7d485e53ac8d75fd6d384906482e38f80 Mon Sep 17 00:00:00 2001
From: Eric Yan <ericyan@github.com>
Date: Wed, 29 Jul 2026 10:57:12 +0000
Subject: [PATCH 1/2] Upgrade Go to 1.25.12

Update the module, Docker build/test images, and local Go bootstrap script
to use Go 1.25.12, which includes fixes for the addressed Go CVEs.
---
 Dockerfile.packaging       | 2 +-
 Dockerfile.test            | 2 +-
 go.mod                     | 2 +-
 script/ensure-go-installed | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Dockerfile.packaging b/Dockerfile.packaging
index 7c4a1db84..36449c6dd 100644
--- a/Dockerfile.packaging
+++ b/Dockerfile.packaging
@@ -1,4 +1,4 @@
-FROM golang:1.25.9-bookworm AS build
+FROM golang:1.25.12-bookworm AS build
 
 # build.sh shells out to fpm to produce the .deb/.rpm packages. fpm is a Ruby
 # gem (needs ruby + ruby-dev + a C toolchain), and the rpm target needs
diff --git a/Dockerfile.test b/Dockerfile.test
index 562308d8e..b4ef586bd 100644
--- a/Dockerfile.test
+++ b/Dockerfile.test
@@ -1,4 +1,4 @@
-FROM golang:1.25.9-bookworm
+FROM golang:1.25.12-bookworm
 LABEL maintainer="github@github.com"
 
 RUN apt-get update
diff --git a/go.mod b/go.mod
index dc49791ef..af30097c3 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/github/gh-ost
 
-go 1.25.9
+go 1.25.12
 
 require (
 	github.com/DataDog/datadog-go/v5 v5.8.3
diff --git a/script/ensure-go-installed b/script/ensure-go-installed
index 917f7a433..13efc8b78 100755
--- a/script/ensure-go-installed
+++ b/script/ensure-go-installed
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-PREFERRED_GO_VERSION=go1.25.9
+PREFERRED_GO_VERSION=go1.25.12
 SUPPORTED_GO_VERSIONS='go1.2[012345]'
 
 GO_PKG_DARWIN=${PREFERRED_GO_VERSION}.darwin-amd64.pkg

From 83d48248a3f14e9ac0c1d700b8022b492b3b8e89 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 11:03:53 +0000
Subject: [PATCH 2/2] Fix Go 1.25.12 checksum constants in ensure-go-installed

---
 script/ensure-go-installed | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/script/ensure-go-installed b/script/ensure-go-installed
index 13efc8b78..f7a522497 100755
--- a/script/ensure-go-installed
+++ b/script/ensure-go-installed
@@ -4,10 +4,10 @@ PREFERRED_GO_VERSION=go1.25.12
 SUPPORTED_GO_VERSIONS='go1.2[012345]'
 
 GO_PKG_DARWIN=${PREFERRED_GO_VERSION}.darwin-amd64.pkg
-GO_PKG_DARWIN_SHA=2254498b78a9bf81188e9daca5573df68ca04e5a67cbd508461b3f37506cef83
+GO_PKG_DARWIN_SHA=2c6b49d08e1ba340d0608d4c64ea5dbbd7f635763dec456fb87ad0d0d6629367
 
 GO_PKG_LINUX=${PREFERRED_GO_VERSION}.linux-amd64.tar.gz
-GO_PKG_LINUX_SHA=00859d7bd6defe8bf84d9db9e57b9a4467b2887c18cd93ae7460e713db774bc1
+GO_PKG_LINUX_SHA=234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
 
 export ROOTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd $ROOTDIR