summaryrefslogtreecommitdiff
path: root/gnu/packages/golang.scm
diff options
context:
space:
mode:
authorSharlatan Hellseher <sharlatanus@gmail.com>2026-04-30 23:50:50 +0100
committerSharlatan Hellseher <sharlatanus@gmail.com>2026-05-15 13:05:22 +0100
commit20d54481ec8e20d82dfda7927f37ab42d73e030e (patch)
tree9ac5ca402b8e3ad4f3b1c9f9495c23648d2af9ba /gnu/packages/golang.scm
parent01038288e59f51512d0e4ee942e550d8a12ca158 (diff)
gnu: go-1.26: Update to 1.26.2 [security-fixes].
go1.26.2 (released 2026-04-07) includes security fixes to the go command, the compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os packages, as well as bug fixes to the go command, the go fix command, the compiler, the linker, the runtime, and the net, net/http, and net/url packages. See: <https://github.com/golang/go/milestone/430> Containes fixes for: CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux CVE-2026-32289: html/template: JS template literal context incorrectly tracked CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination CVE-2026-32288: rchive/tar: unbounded allocation when parsing old format GNU sparse map CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG CVE-2026-32280: crypto/x509: unexpected work during chain building CVE-2026-32281: crypto/x509: inefficient policy validation CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains * gnu/packages/golang.scm (go-1.26): Update to 1.26.2. Change-Id: I634c908bc4f2a1dd37a1405e2277c60846c2a43e
Diffstat (limited to 'gnu/packages/golang.scm')
-rw-r--r--gnu/packages/golang.scm6
1 files changed, 3 insertions, 3 deletions
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index 8088f5bb479..d2d5fdce992 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -1120,7 +1120,7 @@ in the style of communicating sequential processes (@dfn{CSP}).")
1120 (package 1120 (package
1121 (inherit go-1.24) 1121 (inherit go-1.24)
1122 (name "go") 1122 (name "go")
1123 (version "1.26.1") 1123 (version "1.26.2")
1124 (source 1124 (source
1125 (origin 1125 (origin
1126 (method git-fetch) 1126 (method git-fetch)
@@ -1129,9 +1129,9 @@ in the style of communicating sequential processes (@dfn{CSP}).")
1129 (commit (string-append "go" version)))) 1129 (commit (string-append "go" version))))
1130 (file-name (git-file-name name version)) 1130 (file-name (git-file-name name version))
1131 (sha256 1131 (sha256
1132 (base32 "1blfc89jxlr7n35j77i523k8rsxvz16f44qzd0h65c940zrrmf77")))) 1132 (base32 "01dgshhn38dgxmbn02knnvddirmkwgvr3v003dml5q87qibzvg30"))))
1133 (arguments 1133 (arguments
1134 (substitute-keyword-arguments (package-arguments go-1.24) 1134 (substitute-keyword-arguments arguments
1135 ((#:phases phases) 1135 ((#:phases phases)
1136 #~(modify-phases #$phases 1136 #~(modify-phases #$phases
1137 ;; There is no real discussion on the issue among humans, a lot 1137 ;; There is no real discussion on the issue among humans, a lot