Re: [Buildroot] [PATCH v2 1/1] package/go: security bump to version 1.26.1

[Julien Olivain via buildroot <buildroot@buildroot.org>]

Hi Peter, All,

On 13/03/2026 18:14, Peter Korsgaard wrote:
>>>>>> "Julien" == Julien Olivain via buildroot <buildroot@buildroot.org> 
>>>>>> writes:
> 
>  > On 12/03/2026 08:57, Christian Stewart via buildroot wrote:
>  >> Building Go 1.26 and later requires Go 1.24.6 or later for 
> bootstrap.
>  >> To support this we use Go version 1.25.8 as the version for
>  >> go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
>  >> go-bootstrap-stage5.
>  >> Go version 1.25.8 is the latest Go version we can build using
>  >> go-bootstrap-stage4.
>  >> The package build for go-bootstrap-stage5 is effectively identical
>  >> to
>  >> go-bootstrap-stage4 with only the Go version and stage number 
> changed.
>  >> Go 1.28 is expected to require a minor release of Go 1.26 for
>  >> bootstrap.
>  >> Fixes the following security vulnerabilities:
>  >> - CVE-2026-25679: net/url: reject IPv6 literal not at start of host
>  >> - CVE-2026-27142: html/template: URLs in meta attribute actions not
>  >> escaped
>  >> - CVE-2026-27137: crypto/x509: incorrect enforcement of email
>  >> constraints
>  >> - CVE-2026-27138: crypto/x509: panic in name constraint checking:
>  >> certificates
>  >> - CVE-2026-27139: os: FileInfo can escape from a Root
>  >> For full release notes, see:
>  >> https://go.dev/doc/devel/release#go1.26.0
>  >> Signed-off-by: Christian Stewart <christian@aperture.us>
> 
>  > Applied to master, thanks.
> 
> NIT: It would have been better to first bump to 1.25.8 (which includes
> the same security fixes) and then afterwards add the feature bump from
> 1.25.x to 1.26.x so the security fix could be backported.

I thought about that. We usually do that for LTS maintainers to
cherry pick the bump. But the LTS branch is including go 1.23.12.
https://gitlab.com/buildroot.org/buildroot/-/blob/2025.02.x/package/go/go.mk#L7

For which branch you wanted this patch to be backported to?

> --
> Bye, Peter Korsgaard

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot