diff options
| author | Sharlatan Hellseher <sharlatanus@gmail.com> | 2026-04-30 23:50:50 +0100 |
|---|---|---|
| committer | Sharlatan Hellseher <sharlatanus@gmail.com> | 2026-05-15 13:05:22 +0100 |
| commit | 20d54481ec8e20d82dfda7927f37ab42d73e030e (patch) | |
| tree | 9ac5ca402b8e3ad4f3b1c9f9495c23648d2af9ba /gnu | |
| parent | 01038288e59f51512d0e4ee942e550d8a12ca158 (diff) | |
gnu: go-1.26: Update to 1.26.2 [security-fixes].
go1.26.2 (released 2026-04-07) includes security fixes to the go
command, the compiler, and the archive/tar, crypto/tls, crypto/x509,
html/template, and os packages, as well as bug fixes to the go command,
the go fix command, the compiler, the linker, the runtime, and the net,
net/http, and net/url packages.
See: <https://github.com/golang/go/milestone/430>
Containes fixes for:
CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on
Linux
CVE-2026-32289: html/template: JS template literal context incorrectly
tracked
CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap
checking
CVE-2026-27143: cmd/compile: possible memory corruption after bound
check elimination
CVE-2026-32288: rchive/tar: unbounded allocation when parsing old format
GNU sparse map
CVE-2026-32283: crypto/tls: multiple key update handshake messages can
cause connection to deadlock
CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
CVE-2026-32280: crypto/x509: unexpected work during chain building
CVE-2026-32281: crypto/x509: inefficient policy validation
CVE-2026-33810: crypto/x509: excluded DNS constraints not properly
applied to wildcard domains
* gnu/packages/golang.scm (go-1.26): Update to 1.26.2.
Change-Id: I634c908bc4f2a1dd37a1405e2277c60846c2a43e
Diffstat (limited to 'gnu')
| -rw-r--r-- | gnu/packages/golang.scm | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm index 8088f5bb479..d2d5fdce992 100644 --- a/gnu/packages/golang.scm +++ b/gnu/packages/golang.scm | |||
| @@ -1120,7 +1120,7 @@ in the style of communicating sequential processes (@dfn{CSP}).") | |||
| 1120 | (package | 1120 | (package |
| 1121 | (inherit go-1.24) | 1121 | (inherit go-1.24) |
| 1122 | (name "go") | 1122 | (name "go") |
| 1123 | (version "1.26.1") | 1123 | (version "1.26.2") |
| 1124 | (source | 1124 | (source |
| 1125 | (origin | 1125 | (origin |
| 1126 | (method git-fetch) | 1126 | (method git-fetch) |
| @@ -1129,9 +1129,9 @@ in the style of communicating sequential processes (@dfn{CSP}).") | |||
| 1129 | (commit (string-append "go" version)))) | 1129 | (commit (string-append "go" version)))) |
| 1130 | (file-name (git-file-name name version)) | 1130 | (file-name (git-file-name name version)) |
| 1131 | (sha256 | 1131 | (sha256 |
| 1132 | (base32 "1blfc89jxlr7n35j77i523k8rsxvz16f44qzd0h65c940zrrmf77")))) | 1132 | (base32 "01dgshhn38dgxmbn02knnvddirmkwgvr3v003dml5q87qibzvg30")))) |
| 1133 | (arguments | 1133 | (arguments |
| 1134 | (substitute-keyword-arguments (package-arguments go-1.24) | 1134 | (substitute-keyword-arguments arguments |
| 1135 | ((#:phases phases) | 1135 | ((#:phases phases) |
| 1136 | #~(modify-phases #$phases | 1136 | #~(modify-phases #$phases |
| 1137 | ;; There is no real discussion on the issue among humans, a lot | 1137 | ;; There is no real discussion on the issue among humans, a lot |
