diff --git a/.drone.yml b/.drone.yml
index 589c20b24..47fd0d7f9 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -12,7 +12,7 @@ steps:
   # We use golangci-lint for linting.
   # See: https://golangci-lint.run/
   - name: lint
-    image: golangci/golangci-lint:v1.57.2
+    image: golangci/golangci-lint:v1.60.3
     volumes:
       - name: go-build-cache
         path: /root/.cache/go-build
@@ -28,7 +28,7 @@ steps:
           - pull_request
 
   - name: test
-    image: golang:1.22-alpine
+    image: golang:1.23.0-alpine
     volumes:
       - name: go-build-cache
         path: /root/.cache/go-build
@@ -38,7 +38,7 @@ steps:
         path: /root/.cache/wazero
     environment:
       CGO_ENABLED: "0"
-      GTS_WAZERO_COMPILATION_CACHE: "/root/.cache/wazero"
+      GTS_WAZERO_COMPILATION_CACHE: "~/.cache/wazero"
     commands:
       - apk update --no-cache && apk add git
       - >-
@@ -94,7 +94,11 @@ steps:
           - pull_request
 
   - name: snapshot
+<<<<<<< HEAD
     image: superseriousbusiness/gotosocial-drone-build:0.6.2 # https://github.com/superseriousbusiness/gotosocial-drone-build
+=======
+    image: superseriousbusiness/gotosocial-drone-build:0.7.0 # https://github.com/superseriousbusiness/gotosocial-drone-build
+>>>>>>> c1543c029 ([chore] Bump tooling versions, bump go -> v1.23.0)
     volumes:
       - name: go-build-cache
         path: /root/.cache/go-build
@@ -141,7 +145,11 @@ steps:
           - main
 
   - name: release
+<<<<<<< HEAD
     image: superseriousbusiness/gotosocial-drone-build:0.6.2 # https://github.com/superseriousbusiness/gotosocial-drone-build
+=======
+    image: superseriousbusiness/gotosocial-drone-build:0.7.0 # https://github.com/superseriousbusiness/gotosocial-drone-build
+>>>>>>> c1543c029 ([chore] Bump tooling versions, bump go -> v1.23.0)
     volumes:
       - name: go-build-cache
         path: /root/.cache/go-build
@@ -210,7 +218,11 @@ clone:
 
 steps:
   - name: mirror
+<<<<<<< HEAD
     image: superseriousbusiness/gotosocial-drone-build:0.6.2
+=======
+    image: superseriousbusiness/gotosocial-drone-build:0.7.0
+>>>>>>> c1543c029 ([chore] Bump tooling versions, bump go -> v1.23.0)
     environment:
       ORIGIN_REPO: https://github.com/superseriousbusiness/gotosocial
       TARGET_REPO: https://codeberg.org/superseriousbusiness/gotosocial
@@ -223,6 +235,10 @@ steps:
 
 ---
 kind: signature
+<<<<<<< HEAD
 hmac: 1b89e3a538fbca72eb9a0b398cd82f09a774ba3649013e19d36012eda327e83f
+=======
+hmac: 90df190a8e49e082ec2a95738bdf44fb049a7ab64b71f522e1f1add1bb061a81
+>>>>>>> c1543c029 ([chore] Bump tooling versions, bump go -> v1.23.0)
 
 ...
diff --git a/Dockerfile b/Dockerfile
index df4fc56da..066ede0e7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,7 +2,7 @@
 # Dockerfile reference: https://docs.docker.com/engine/reference/builder/
 
 # stage 1: generate up-to-date swagger.yaml to put in the final container
-FROM --platform=${BUILDPLATFORM} golang:1.22-alpine AS swagger
+FROM --platform=${BUILDPLATFORM} golang:1.23.0-alpine AS swagger
 
 RUN \
     ### Installs goswagger for building swagger definitions inside this container
@@ -28,7 +28,7 @@ RUN yarn --cwd ./web/source install && \
     rm -rf ./web/source
 
 # stage 3: build the executor container
-FROM --platform=${TARGETPLATFORM} alpine:3.19.1 as executor
+FROM --platform=${TARGETPLATFORM} alpine:3.20.2 as executor
 
 # switch to non-root user:group for GtS
 USER 1000:1000
diff --git a/internal/db/bundb/bundb.go b/internal/db/bundb/bundb.go
index d10f372fd..8756e086b 100644
--- a/internal/db/bundb/bundb.go
+++ b/internal/db/bundb/bundb.go
@@ -420,13 +420,12 @@ func maxOpenConns() int {
 // deriveBunDBPGOptions takes an application config and returns either a ready-to-use set of options
 // with sensible defaults, or an error if it's not satisfied by the provided config.
 func deriveBunDBPGOptions() (*pgx.ConnConfig, error) {
-	url := config.GetDbPostgresConnectionString()
-
-	// if database URL is defined, ignore other DB related configuration fields
-	if url != "" {
-		cfg, err := pgx.ParseConfig(url)
-		return cfg, err
+	// If database URL is defined, ignore
+	// other DB-related configuration fields.
+	if url := config.GetDbPostgresConnectionString(); url != "" {
+		return pgx.ParseConfig(url)
 	}
+
 	// these are all optional, the db adapter figures out defaults
 	address := config.GetDbAddress()
 
diff --git a/internal/media/imaging.go b/internal/media/imaging.go
index 6a0fa694c..487b41b5f 100644
--- a/internal/media/imaging.go
+++ b/internal/media/imaging.go
@@ -514,6 +514,9 @@ func (s *scanner) scan(x1, y1, x2, y2 int, dst []uint8) {
 				} else {
 					r = ^(r >> 31)
 				}
+				if r > math.MaxUint8 {
+					panic("overflow r")
+				}
 
 				g := yy1 - 22554*cb1 - 46802*cr1
 				if uint32(g)&0xff000000 == 0 { //nolint:gosec
@@ -521,6 +524,9 @@ func (s *scanner) scan(x1, y1, x2, y2 int, dst []uint8) {
 				} else {
 					g = ^(g >> 31)
 				}
+				if g > math.MaxUint8 {
+					panic("overflow g")
+				}
 
 				b := yy1 + 116130*cb1
 				if uint32(b)&0xff000000 == 0 { //nolint:gosec
@@ -528,6 +534,9 @@ func (s *scanner) scan(x1, y1, x2, y2 int, dst []uint8) {
 				} else {
 					b = ^(b >> 31)
 				}
+				if b > math.MaxUint8 {
+					panic("overflow b")
+				}
 
 				d := dst[j : j+4 : j+4]
 				d[0] = uint8(r) // #nosec G115 -- Overflow desired.