Update vulnerable Go dependencies and toolchain

[zachlatta]

What changed

• Updated the dependency families covered by the nine pending Dependabot PRs to their current compatible releases, including go-git, go-billy, pgx, AWS SDK/S3, x/crypto, x/net, x/image, circl, and their transitive modules.
• Raised the project toolchain and production/development container images to Go 1.25.12, which is required by go-git v5.19.1 and includes the current security fixes.
• Refreshed go.sum with go mod tidy.

Why

The pending bot PRs overlap in go.mod/go.sum, several are conflicted, and several proposed versions are already stale. Merging them independently would leave known Dependabot alerts open and the go-git update would raise the module's Go requirement without updating the Docker images.

This consolidated update brings every package named by the repository's 41 open Dependabot alerts to its patched version or newer while keeping all dependencies on their existing major versions.

Validation

• GOTOOLCHAIN=go1.25.12 go build ./...
• GOTOOLCHAIN=go1.25.12 go vet ./...
• GOTOOLCHAIN=go1.25.12 go test ./... -count=1
• GOTOOLCHAIN=go1.25.12 go test -race ./... -count=1
• PostgreSQL-backed full test suite with ARKER_TEST_POSTGRES_DSN
• go mod verify
• govulncheck ./... under Go 1.25.12: no vulnerabilities found in called code
• docker buildx build --check .
• Full production docker build
• Production container smoke test against PostgreSQL: /health returned healthy

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​aws/​aws-sdk-go-v2@​v1.39.0 ⏵ v1.42.1	+1
	github.com/​jackc/​pgx/​v5@​v5.7.5 ⏵ v5.10.0	-3	+75
	golang.org/​x/​crypto@​v0.38.0 ⏵ v0.54.0	+1	+75
	golang.org/​x/​net@​v0.39.0 ⏵ v0.57.0		+3
	github.com/​go-git/​go-git/​v5@​v5.8.1 ⏵ v5.19.1	-2	+75
	github.com/​aws/​aws-sdk-go-v2/​config@​v1.31.8 ⏵ v1.32.30	+1
	github.com/​aws/​aws-sdk-go-v2/​service/​s3@​v1.88.1 ⏵ v1.105.1	-3	+2
	github.com/​aws/​aws-sdk-go-v2/​credentials@​v1.18.12 ⏵ v1.19.29	+1

View full report