deps: bump pingcap base image to v1.12.3

[wuhuizuo]

What problem does this PR solve?

Bump the ghcr.io/pingcap-qe/bases/pingcap-base base image from v1.12.2 to v1.12.3 (digest-pinned) across the five Dockerfiles that reference it. This is a routine base-image refresh, picking up the latest base image patch release.

What is changed and how does it work?

No operator code changes. Only the FROM line of five Dockerfiles is updated:

• cmd/http-service/Dockerfile
• images/br-federation-manager/Dockerfile
• images/br-federation-manager/Dockerfile.e2e
• images/tidb-operator/Dockerfile
• images/tidb-operator/Dockerfile.e2e

The tag moves v1.12.2 -> v1.12.3 and the digest is re-pinned to the v1.12.3 manifest-list digest (sha256:eee0c7a72ce382ec2bca340c6ab4c996e56a5d9deb3745ebcbe43d65bec86b88), obtained from the ghcr.io registry (anonymous token + Docker-Content-Digest header on the manifest-list media type). This matches the digest-pinning convention used in previous bumps (#7020 / #7021).

Code changes

• Has Go code change
• Has CI related scripts change

Tests

• Unit test
• E2E test
• Manual test
• No code

Local verification:

• git diff shows exactly the five FROM lines changed, nothing else.
• The digest matches the v1.12.3 manifest-list digest returned by the ghcr registry, and the v1.12.2 digest (0777...) previously pinned in these files matches the same query against the v1.12.2 tag, confirming the digest type is consistent.

Side effects

• Breaking backward compatibility
• Other side effects: base image patch release; no functional change expected. CI image builds will pull the new base layer.

Related changes

• Need to cherry-pick to the release branch
• Need to update the documentation

No cherry-pick is required: counterpart PRs covering all currently maintained release branches are opened directly (release-1.x (#7040), main (#7038), release-2.1 (#7042)).

Release Notes

Bump the pingcap base image to v1.12.3.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: eb9d47ae-c894-4688-99ac-1928fdfae670

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[liubog2008]

/test pull-e2e-kind-br

[liubog2008]

/lgtm

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liubog2008

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [liubog2008]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-08-26 08:16:19.4577054 +0000 UTC m=+662414.628799519: ☑️ agreed by liubog2008.