

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13373): <!--number 13373 --><!--line 0 --><!--description Zml4OiBkb24ndCBjYWNoZSB3cml0ZSBwZXJtaXNzaW9uIG9uIGZpcnN0IHB1c2hlZCBnaXQgcmVmZXJlbmNl-->fix: don't cache write permission on first pushed git reference<!--description-->
- Included for completeness but not user-facing (chores, etc.)
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13352): <!--number 13352 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnaXRodWIuY29tL3l1aW4vZ29sZG1hcmsgdG8gdjEuNy4xNyBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update module github.com/yuin/goldmark to v1.7.17 [SECURITY] (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13365): <!--number 13365 --><!--line 0 --><!--description VXBkYXRlIGdvIHRvb2xjaGFpbiBkaXJlY3RpdmUgdG8gdjEuMjUuMTIgW1NFQ1VSSVRZXSAodjExLjAvZm9yZ2Vqbyk=-->Update go toolchain directive to v1.25.12 [SECURITY] (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13197): <!--number 13197 --><!--line 0 --><!--description VXBkYXRlIG1vZHVsZSBnb2xhbmcub3JnL3gvaW1hZ2UgdG8gdjAuNDMuMCBbU0VDVVJJVFldICh2MTEuMC9mb3JnZWpvKQ==-->Update module golang.org/x/image to v0.43.0 [SECURITY] (v11.0/forgejo)<!--description-->
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/13116) ([backported](https://codeberg.org/forgejo/forgejo/pulls/13120)): <!--number 13120 --><!--line 0 --><!--description Y2k6IGRvbid0IHVzZSByZWRpY3QgZHVyaW5nIEZvcmdlam8gdGVzdGluZw==-->ci: don't use redict during Forgejo testing<!--description-->
<!--end release-notes-assistant-->