Bump Go version to 1.25.12 for 1.15.x

[apoiget]

Bump Go version toolchain to 1.25.12 on branch for 1.15 to fix security vulnerabilities.

the terraform 1.15.8 version, return this trivy scan :

trivy rootfs --scanners vuln terraform

2026-08-11T20:45:13Z    INFO    [vuln] Vulnerability scanning is enabled
2026-08-11T20:45:13Z    INFO    Number of language-specific files       num=1
2026-08-11T20:45:13Z    INFO    [gobinary] Detecting vulnerabilities...
2026-08-11T20:45:13Z    WARN    Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.73/guide/scanner/vulnerability#severity-selection for details.

Report Summary

┌───────────┬──────────┬─────────────────┐
│  Target   │   Type   │ Vulnerabilities │
├───────────┼──────────┼─────────────────┤
│ terraform │ gobinary │        9        │
└───────────┴──────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


terraform (gobinary)

Total: 9 (UNKNOWN: 2, LOW: 0, MEDIUM: 2, HIGH: 5, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬──────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │  Status  │ Installed Version │        Fixed Version         │                            Title                             │
├────────────────────────┼─────────────────────┼──────────┼──────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto    │ GO-2026-5932        │ UNKNOWN  │ affected │ v0.52.0           │                              │ The golang.org/x/crypto/openpgp package is unmaintained,     │
│                        │                     │          │          │                   │                              │ unsafe by design, and has known security...                  │
├────────────────────────┼─────────────────────┤          ├──────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2026-46600      │          │ fixed    │ v0.55.0           │ 0.56.0                       │ Parsing an invalid SVCB or HTTPS RR can panic when the       │
│                        │                     │          │          │                   │                              │ size...                                                      │
│                        │                     │          │          │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-46600                   │
├────────────────────────┼─────────────────────┼──────────┤          ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/text      │ CVE-2026-56852      │ HIGH     │          │ v0.37.0           │ 0.39.0                       │ golang.org/x/text: golang.org/x/text: Denial of Service via  │
│                        │                     │          │          │                   │                              │ invalid UTF-8 input                                          │
│                        │                     │          │          │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-56852                   │
├────────────────────────┼─────────────────────┤          │          ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │          │          │ v1.80.0           │ 1.82.1                       │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities                 │
│                        │                     │          │          │                   │                              │ https://github.com/advisories/GHSA-hrxh-6v49-42gf            │
├────────────────────────┼─────────────────────┤          │          ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                 │ CVE-2026-27145      │          │          │ v1.25.10          │ 1.25.11, 1.26.4              │ crypto/x509: golang: golang crypto/x509: Denial of Service   │
│                        │                     │          │          │                   │                              │ via excessive processing of DNS...                           │
│                        │                     │          │          │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-27145                   │
│                        ├─────────────────────┤          │          │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2026-39822      │          │          │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ golang: Go os.Root: Symlink following vulnerability allows   │
│                        │                     │          │          │                   │                              │ directory traversal                                          │
│                        │                     │          │          │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-39822                   │
│                        ├─────────────────────┤          │          │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2026-42504      │          │          │                   │ 1.25.11, 1.26.4              │ mime: golang: Golang MIME: Denial of Service via             │
│                        │                     │          │          │                   │                              │ maliciously-crafted MIME header                              │
│                        │                     │          │          │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42504                   │
│                        ├─────────────────────┼──────────┤          │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2026-42505      │ MEDIUM   │          │                   │ 1.25.12, 1.26.5, 1.27.0-rc.2 │ crypto/tls: golang: Go crypto/tls: Information disclosure in │
│                        │                     │          │          │                   │                              │ Encrypted Client Hello                                       │
│                        │                     │          │          │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42505                   │
│                        ├─────────────────────┤          │          │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2026-42507      │          │          │                   │ 1.25.11, 1.26.4              │ net/textproto: golang: Golang net/textproto: Misleading      │
│                        │                     │          │          │                   │                              │ error messages via input injection                           │
│                        │                     │          │          │                   │                              │ https://avd.aquasec.com/nvd/cve-2026-42507                   │
└────────────────────────┴─────────────────────┴──────────┴──────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

with the already libraries updated and now thiw golan toolchain

 trivy rootfs --scanners vuln terraform 
2026-08-11T20:43:28Z    INFO    [vuln] Vulnerability scanning is enabled
2026-08-11T20:43:29Z    INFO    Number of language-specific files       num=1
2026-08-11T20:43:29Z    INFO    [gobinary] Detecting vulnerabilities...
2026-08-11T20:43:29Z    WARN    Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.73/guide/scanner/vulnerability#severity-selection for details.

Report Summary

┌───────────┬──────────┬─────────────────┐
│  Target   │   Type   │ Vulnerabilities │
├───────────┼──────────┼─────────────────┤
│ terraform │ gobinary │        1        │
└───────────┴──────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


terraform (gobinary)

Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌─────────────────────┬───────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability │ Severity │  Status  │ Installed Version │ Fixed Version │                          Title                           │
├─────────────────────┼───────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ GO-2026-5932  │ UNKNOWN  │ affected │ v0.53.0           │               │ The golang.org/x/crypto/openpgp package is unmaintained, │
│                     │               │          │          │                   │               │ unsafe by design, and has known security...              │
└─────────────────────┴───────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.

[github-actions]

Changelog Warning

Currently this PR would target a v1.15 release. Please add a changelog entry for in the .changes/v1.15 folder, or discuss which release you'd like to target with your reviewer. If you believe this change does not need a changelog entry, please add the 'no-changelog-needed' label.