guix/gnu/packages/golang.scm, branch master Transactional package manager, declarative GNU/Linux distribution, reproducible deployment tool, and more! https://guix.gnu.org gnu: go-1.27: Update to 1.27.0 and deprecate go-next in favor of it. 2026-08-25T23:39:39+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-08-21T09:46:49+00:00 6c082f7d66c4cbce6ed856cc811ea00999c583c8 * gnu/packages/golang.scm (go-1.27): Update to 1.27.0. [name]: Change to "go". (go-next): New variable. Merges: guix/guix!10699 
* gnu/packages/golang.scm (go-1.27): Update to 1.27.0.
[name]: Change to "go".
(go-next): New variable.

Merges: guix/guix!10699
gnu: go-1.27: Update to 1.27rc3. 2026-08-16T21:30:37+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-08-16T20:56:43+00:00 bec4036042824137d82bc052554d39021ef139c5 * gnu/packages/golang.scm (go-1.27): Update to 1.27rc3. 
* gnu/packages/golang.scm (go-1.27): Update to 1.27rc3.
gnu: go-1.26: Update to 1.26.6 [security-fixes]. 2026-08-16T21:30:36+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-08-16T21:11:15+00:00 277cdcc5b3fd48d52e680418822ac95bf05ab6ae go1.26.6 (released 2026-08-13) includes security fixes to the go command, and the crypto/tls, encoding/asn1, encoding/xml, html/template, net, net/http, and net/url packages, as well as bug fixes to the compiler, the linker, the runtime, and the crypto/tls and os packages. See: <https://github.com/golang/go/milestone/441>, <https://groups.google.com/g/golang-announce/c/94pEornpRlI> Contains fixes for: CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup CVE-2026-56859: encoding/xml: add recursion depth guard during decode CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath CVE-2026-46600: golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record CVE-2026-56862: crypto/tls: limit handshake messages we are willing to accept post-handshake CVE-2026-56858: html/template: fix Javascript regexp context tracking CVE-2026-39821: x/net/idna: failure to reject ASCII-only Punycode-encoded labels CVE-2026-33818: encoding/asn1: enforce maximum recursion depth * gnu/packages/golang.scm (go-1.26): Update to 1.26.6. 
go1.26.6 (released 2026-08-13) includes security fixes to the go
command, and the crypto/tls, encoding/asn1, encoding/xml, html/template,
net, net/http, and net/url packages, as well as bug fixes to the
compiler, the linker, the runtime, and the crypto/tls and os packages.

See: <https://github.com/golang/go/milestone/441>,
<https://groups.google.com/g/golang-announce/c/94pEornpRlI>

Contains fixes for:
CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification
                bypass
CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in
                Lookup
CVE-2026-56859: encoding/xml: add recursion depth guard during decode
CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted
                HTTP/2 check
CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath
CVE-2026-46600: golang.org/x/net/dns/dnsmessage: panic when parsing
                invalid SVCB record
CVE-2026-56862: crypto/tls: limit handshake messages we are willing to
                accept post-handshake
CVE-2026-56858: html/template: fix Javascript regexp context tracking
CVE-2026-39821: x/net/idna: failure to reject ASCII-only
                Punycode-encoded labels
CVE-2026-33818: encoding/asn1: enforce maximum recursion depth

* gnu/packages/golang.scm (go-1.26): Update to 1.26.6.
gnu: go-1.27: Update to 1.27rc2. 2026-07-23T20:15:03+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-07-17T08:37:20+00:00 d15e97fb3a5592a1afff2753a7c6af2fcaa836d9 * gnu/packages/golang.scm (go-1.27): Update to 1.27rc2. 
* gnu/packages/golang.scm (go-1.27): Update to 1.27rc2.
gnu: go-1.26: Update to 1.26.5 [security-fixes]. 2026-07-23T20:15:03+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-07-17T08:39:39+00:00 11b4a4ebd384aa015d5aaa102ac0e452fc7d13cc go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages. See: <https://github.com/golang/go/milestone/439>, <https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc>. Contains fixes for: CVE-2026-39822: os: Root escape via symlink plus trailing slash CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak * gnu/packages/golang.scm (go-1.26): Update to 1.26.5. [phases]{remove-testscript-mod_get_fips140_issue73649.txt}: New phase, remove test script file requiring connection to Internet. Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com> 
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages.

See: <https://github.com/golang/go/milestone/439>,
<https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc>.

Contains fixes for:
CVE-2026-39822: os: Root escape via symlink plus trailing slash
CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak

* gnu/packages/golang.scm (go-1.26): Update to 1.26.5.
[phases]{remove-testscript-mod_get_fips140_issue73649.txt}: New phase,
remove test script file requiring connection to Internet.

Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>
gnu: go-1.25: Update to 1.25.12 [security-fixes]. 2026-07-23T20:15:03+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-07-17T08:45:29+00:00 bfed370071e0857b2ad31cc0641b2225a06ab488 go1.25.12 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the go command, and the net and os packages. See: <https://github.com/golang/go/milestone/438>, <https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc>. Contains fixes for: CVE-2026-39822: os: Root escape via symlink plus trailing slash CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak * gnu/packages/golang.scm (go-1.25): Update to 1.25.12. [phases]{remove-testscript-mod_get_fips140_issue73649.txt}: New phase, remove test script file requiring connection to Internet. 
go1.25.12 (released 2026-07-07) includes security fixes to the
crypto/tls and os packages, as well as bug fixes to the compiler, the go
command, and the net and os packages.

See: <https://github.com/golang/go/milestone/438>,
<https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc>.

Contains fixes for:
CVE-2026-39822: os: Root escape via symlink plus trailing slash
CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak

* gnu/packages/golang.scm (go-1.25): Update to 1.25.12.
[phases]{remove-testscript-mod_get_fips140_issue73649.txt}: New phase,
remove test script file requiring connection to Internet.
gnu: go-1.25: Update to 1.25.11 [security-fixes] 2026-07-23T20:14:48+00:00 Ankit Gadiya git@argp.in 2026-06-03T18:10:55+00:00 d88b175e9ddc31fcd1dde2494dc0db2bb6fd1fee go1.25.11 (released 2026-06-03) includes security fixes to the mine, net/textproto, and crypto/x509 packages. See: <https://github.com/golang/go/milestone/436>, <https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw>. Contains fixes for: CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping CVE-2026-27145: crypto/x509: split candidate hostname only once * gnu/packages/golang.scm (go-1.25): Update to 1.25.11. Merges: guix/guix!9133 Change-Id: I9e179c511f6cdb942fdb8e65b166c6b87f128129 Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com> 
go1.25.11 (released 2026-06-03) includes security fixes to the
mine, net/textproto, and crypto/x509 packages.
See: <https://github.com/golang/go/milestone/436>,
<https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw>.

Contains fixes for:
CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
CVE-2026-42507: net/textproto: arbitrary input are included in errors
                without any escaping
CVE-2026-27145: crypto/x509: split candidate hostname only once

* gnu/packages/golang.scm (go-1.25): Update to 1.25.11.

Merges: guix/guix!9133
Change-Id: I9e179c511f6cdb942fdb8e65b166c6b87f128129
Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>
gnu: Add go-next (go-1.27). 2026-07-08T22:26:46+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-07-02T19:10:22+00:00 733be4b68b4521e86bd66cc2e35e250383e78175 * gnu/packages/golang.scm (go-1.27, go-std-1.27): New variables. Merges: guix/guix!9666 
* gnu/packages/golang.scm (go-1.27, go-std-1.27): New variables.

Merges: guix/guix!9666
gnu: go-1.26: Update to 1.26.4 [security-fixes] 2026-06-07T19:24:30+00:00 Ankit Gadiya git@argp.in 2026-06-03T18:16:58+00:00 11a3b576e0b2b717fc59bd50a3b16be0b1580c74 go1.26.4 (released 2026-06-03) includes security fixes to the mine, net/textproto, and crypto/x509 packages. See: <https://github.com/golang/go/milestone/435>, <https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw>. Contains fixes for: CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping CVE-2026-27145: crypto/x509: split candidate hostname only once * gnu/packages/golang.scm (go-1.26): Update to 1.26.4. Merges: guix/guix!9081 Change-Id: I345f8829192e150590769bfa359c9e6ab06b421d Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com> 
go1.26.4 (released 2026-06-03) includes security fixes to the mine,
net/textproto, and crypto/x509 packages.
See: <https://github.com/golang/go/milestone/435>,
<https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw>.

Contains fixes for:
CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
CVE-2026-42507: net/textproto: arbitrary input are included in errors
                without any escaping
CVE-2026-27145: crypto/x509: split candidate hostname only once

* gnu/packages/golang.scm (go-1.26): Update to 1.26.4.

Merges: guix/guix!9081
Change-Id: I345f8829192e150590769bfa359c9e6ab06b421d
Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>
gnu: packages/golang: Add comment about boostrap versions. 2026-06-03T20:00:34+00:00 Sharlatan Hellseher sharlatanus@gmail.com 2026-04-30T22:51:59+00:00 4bc98468ecc94a76513bb9ccced40ccf72ef8c67 * gnu/packages/golang.scm: Copy upstream explanation on the minimal bootstrap version for Go. Change-Id: Ic51e9316bdd5573c1a158b320343ae72a07eeebe 
* gnu/packages/golang.scm: Copy upstream explanation on the minimal
bootstrap version for Go.

Change-Id: Ic51e9316bdd5573c1a158b320343ae72a07eeebe