Re: [Buildroot] [PATCH v2 1/1] package/go: security bump to version 1.26.1

[Julien Olivain via buildroot <buildroot@buildroot.org>]

On 12/03/2026 08:57, Christian Stewart via buildroot wrote:
> Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.
> 
> To support this we use Go version 1.25.8 as the version for
> go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
> go-bootstrap-stage5.
> 
> Go version 1.25.8 is the latest Go version we can build using
> go-bootstrap-stage4.
> 
> The package build for go-bootstrap-stage5 is effectively identical to
> go-bootstrap-stage4 with only the Go version and stage number changed.
> 
> Go 1.28 is expected to require a minor release of Go 1.26 for 
> bootstrap.
> 
> Fixes the following security vulnerabilities:
> 
> - CVE-2026-25679: net/url: reject IPv6 literal not at start of host
> - CVE-2026-27142: html/template: URLs in meta attribute actions not 
> escaped
> - CVE-2026-27137: crypto/x509: incorrect enforcement of email 
> constraints
> - CVE-2026-27138: crypto/x509: panic in name constraint checking: 
> certificates
> - CVE-2026-27139: os: FileInfo can escape from a Root
> 
> For full release notes, see:
> https://go.dev/doc/devel/release#go1.26.0
> 
> Signed-off-by: Christian Stewart <christian@aperture.us>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot