* [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5
@ 2026-07-13 20:39 Christian Stewart via buildroot
2026-07-14 8:26 ` Julien Olivain via buildroot
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Christian Stewart via buildroot @ 2026-07-13 20:39 UTC (permalink / raw)
To: buildroot
Cc: Thomas Petazzoni, Julien Olivain, James Hilliard,
Christian Stewart, Thomas Perale
Fixes the following security issues:
CVE-2026-39822: os: root escape via symlink plus trailing slash
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages.
https://go.dev/doc/devel/release#go1.26.5
Signed-off-by: Christian Stewart <christian@aperture.us>
---
package/go/go.hash | 14 +++++++-------
package/go/go.mk | 2 +-
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/package/go/go.hash b/package/go/go.hash
index 69f2a3139c8..6c9c20be69e 100644
--- a/package/go/go.hash
+++ b/package/go/go.hash
@@ -1,9 +1,9 @@
# sha256 checksum from https://go.dev/dl/
-sha256 1c646875d0aa8799133184ed57cf79ff24bdefe8c8820470602a9d3d6d9192b8 go1.26.3.src.tar.gz
-sha256 0ef3626a149b5811c813838c62b7d6618d03ea36047b32c90b0e4851cc42b1fa go1.26.3.linux-386.tar.gz
-sha256 2b2cfc7148493da5e73981bffbf3353af381d5f93e789c82c79aff64962eb556 go1.26.3.linux-amd64.tar.gz
-sha256 9d89a3ea57d141c2b22d70083f2c8459ba3890f2d9e818e7e933b75614936565 go1.26.3.linux-arm64.tar.gz
-sha256 d44133d4c66b1451a1e247da26db7716f76a081c0169a75e6c84e1871e394320 go1.26.3.linux-armv6l.tar.gz
-sha256 dbd82b50530ead2beb1fd72215117380df3cb16332b51467116dc35b3691dd75 go1.26.3.linux-ppc64le.tar.gz
-sha256 5c0605b7175449f1c8e8cb02efaba2695caab914fad4dcedc764c2f4c6dfe6ca go1.26.3.linux-s390x.tar.gz
+sha256 495be4bc87176ac567392e5b4116abd98466d33d7b49d41e764ccc6976b2dc42 go1.26.5.src.tar.gz
+sha256 88c162b204e6eefcc32499453b492e80209f4a4c78c33092636901c540fb0d05 go1.26.5.linux-386.tar.gz
+sha256 5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053 go1.26.5.linux-amd64.tar.gz
+sha256 fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49 go1.26.5.linux-arm64.tar.gz
+sha256 6dae9edab81c13bccf962dec15f1fd2ec26c14a6821b4d2c92dab4130c289d7a go1.26.5.linux-armv6l.tar.gz
+sha256 c5d60e2b303bb612f20cd82786594b64874e73b35134025e27d3390bf284ae43 go1.26.5.linux-ppc64le.tar.gz
+sha256 09ce3c504c0323968b75a717244dca4f25cd4cf0443e5ff6bc0bfa74add89fa7 go1.26.5.linux-s390x.tar.gz
sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE
diff --git a/package/go/go.mk b/package/go/go.mk
index ebd0d418efa..a64d7538f85 100644
--- a/package/go/go.mk
+++ b/package/go/go.mk
@@ -4,7 +4,7 @@
#
################################################################################
-GO_VERSION = 1.26.3
+GO_VERSION = 1.26.5
HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache
--
2.53.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5
2026-07-13 20:39 [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5 Christian Stewart via buildroot
@ 2026-07-14 8:26 ` Julien Olivain via buildroot
2026-07-17 15:47 ` Thomas Perale via buildroot
2026-07-31 12:04 ` Thomas Perale via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Julien Olivain via buildroot @ 2026-07-14 8:26 UTC (permalink / raw)
To: Christian Stewart
Cc: buildroot, Thomas Petazzoni, James Hilliard, Thomas Perale
On 13/07/2026 22:39, Christian Stewart via buildroot wrote:
> Fixes the following security issues:
>
> CVE-2026-39822: os: root escape via symlink plus trailing slash
>
> go1.26.5 (released 2026-07-07) includes security fixes to the
> crypto/tls and os packages, as well as bug fixes to the compiler, the
> runtime, the go command, and the net, os, and syscall packages.
>
> https://go.dev/doc/devel/release#go1.26.5
> Signed-off-by: Christian Stewart <christian@aperture.us>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5
2026-07-13 20:39 [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5 Christian Stewart via buildroot
2026-07-14 8:26 ` Julien Olivain via buildroot
@ 2026-07-17 15:47 ` Thomas Perale via buildroot
2026-07-31 12:04 ` Thomas Perale via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Thomas Perale via buildroot @ 2026-07-17 15:47 UTC (permalink / raw)
To: Christian Stewart; +Cc: Thomas Perale, buildroot
In reply of:
> Fixes the following security issues:
>
> CVE-2026-39822: os: root escape via symlink plus trailing slash
>
> go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages.
>
> https://go.dev/doc/devel/release#go1.26.5
> Signed-off-by: Christian Stewart <christian@aperture.us>
Applied to 2026.05.x. Thanks
> ---
> package/go/go.hash | 14 +++++++-------
> package/go/go.mk | 2 +-
> 2 files changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/package/go/go.hash b/package/go/go.hash
> index 69f2a3139c8..6c9c20be69e 100644
> --- a/package/go/go.hash
> +++ b/package/go/go.hash
> @@ -1,9 +1,9 @@
> # sha256 checksum from https://go.dev/dl/
> -sha256 1c646875d0aa8799133184ed57cf79ff24bdefe8c8820470602a9d3d6d9192b8 go1.26.3.src.tar.gz
> -sha256 0ef3626a149b5811c813838c62b7d6618d03ea36047b32c90b0e4851cc42b1fa go1.26.3.linux-386.tar.gz
> -sha256 2b2cfc7148493da5e73981bffbf3353af381d5f93e789c82c79aff64962eb556 go1.26.3.linux-amd64.tar.gz
> -sha256 9d89a3ea57d141c2b22d70083f2c8459ba3890f2d9e818e7e933b75614936565 go1.26.3.linux-arm64.tar.gz
> -sha256 d44133d4c66b1451a1e247da26db7716f76a081c0169a75e6c84e1871e394320 go1.26.3.linux-armv6l.tar.gz
> -sha256 dbd82b50530ead2beb1fd72215117380df3cb16332b51467116dc35b3691dd75 go1.26.3.linux-ppc64le.tar.gz
> -sha256 5c0605b7175449f1c8e8cb02efaba2695caab914fad4dcedc764c2f4c6dfe6ca go1.26.3.linux-s390x.tar.gz
> +sha256 495be4bc87176ac567392e5b4116abd98466d33d7b49d41e764ccc6976b2dc42 go1.26.5.src.tar.gz
> +sha256 88c162b204e6eefcc32499453b492e80209f4a4c78c33092636901c540fb0d05 go1.26.5.linux-386.tar.gz
> +sha256 5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053 go1.26.5.linux-amd64.tar.gz
> +sha256 fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49 go1.26.5.linux-arm64.tar.gz
> +sha256 6dae9edab81c13bccf962dec15f1fd2ec26c14a6821b4d2c92dab4130c289d7a go1.26.5.linux-armv6l.tar.gz
> +sha256 c5d60e2b303bb612f20cd82786594b64874e73b35134025e27d3390bf284ae43 go1.26.5.linux-ppc64le.tar.gz
> +sha256 09ce3c504c0323968b75a717244dca4f25cd4cf0443e5ff6bc0bfa74add89fa7 go1.26.5.linux-s390x.tar.gz
> sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE
> diff --git a/package/go/go.mk b/package/go/go.mk
> index ebd0d418efa..a64d7538f85 100644
> --- a/package/go/go.mk
> +++ b/package/go/go.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -GO_VERSION = 1.26.3
> +GO_VERSION = 1.26.5
>
> HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
> HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache
> --
> 2.53.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5
2026-07-13 20:39 [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5 Christian Stewart via buildroot
2026-07-14 8:26 ` Julien Olivain via buildroot
2026-07-17 15:47 ` Thomas Perale via buildroot
@ 2026-07-31 12:04 ` Thomas Perale via buildroot
2 siblings, 0 replies; 4+ messages in thread
From: Thomas Perale via buildroot @ 2026-07-31 12:04 UTC (permalink / raw)
To: Christian Stewart; +Cc: Thomas Perale, buildroot
In reply of:
> Fixes the following security issues:
>
> CVE-2026-39822: os: root escape via symlink plus trailing slash
>
> go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages.
>
> https://go.dev/doc/devel/release#go1.26.5
> Signed-off-by: Christian Stewart <christian@aperture.us>
Applied to 2025.02.x. Thanks
> ---
> package/go/go.hash | 14 +++++++-------
> package/go/go.mk | 2 +-
> 2 files changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/package/go/go.hash b/package/go/go.hash
> index 69f2a3139c8..6c9c20be69e 100644
> --- a/package/go/go.hash
> +++ b/package/go/go.hash
> @@ -1,9 +1,9 @@
> # sha256 checksum from https://go.dev/dl/
> -sha256 1c646875d0aa8799133184ed57cf79ff24bdefe8c8820470602a9d3d6d9192b8 go1.26.3.src.tar.gz
> -sha256 0ef3626a149b5811c813838c62b7d6618d03ea36047b32c90b0e4851cc42b1fa go1.26.3.linux-386.tar.gz
> -sha256 2b2cfc7148493da5e73981bffbf3353af381d5f93e789c82c79aff64962eb556 go1.26.3.linux-amd64.tar.gz
> -sha256 9d89a3ea57d141c2b22d70083f2c8459ba3890f2d9e818e7e933b75614936565 go1.26.3.linux-arm64.tar.gz
> -sha256 d44133d4c66b1451a1e247da26db7716f76a081c0169a75e6c84e1871e394320 go1.26.3.linux-armv6l.tar.gz
> -sha256 dbd82b50530ead2beb1fd72215117380df3cb16332b51467116dc35b3691dd75 go1.26.3.linux-ppc64le.tar.gz
> -sha256 5c0605b7175449f1c8e8cb02efaba2695caab914fad4dcedc764c2f4c6dfe6ca go1.26.3.linux-s390x.tar.gz
> +sha256 495be4bc87176ac567392e5b4116abd98466d33d7b49d41e764ccc6976b2dc42 go1.26.5.src.tar.gz
> +sha256 88c162b204e6eefcc32499453b492e80209f4a4c78c33092636901c540fb0d05 go1.26.5.linux-386.tar.gz
> +sha256 5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053 go1.26.5.linux-amd64.tar.gz
> +sha256 fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49 go1.26.5.linux-arm64.tar.gz
> +sha256 6dae9edab81c13bccf962dec15f1fd2ec26c14a6821b4d2c92dab4130c289d7a go1.26.5.linux-armv6l.tar.gz
> +sha256 c5d60e2b303bb612f20cd82786594b64874e73b35134025e27d3390bf284ae43 go1.26.5.linux-ppc64le.tar.gz
> +sha256 09ce3c504c0323968b75a717244dca4f25cd4cf0443e5ff6bc0bfa74add89fa7 go1.26.5.linux-s390x.tar.gz
> sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE
> diff --git a/package/go/go.mk b/package/go/go.mk
> index ebd0d418efa..a64d7538f85 100644
> --- a/package/go/go.mk
> +++ b/package/go/go.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -GO_VERSION = 1.26.3
> +GO_VERSION = 1.26.5
>
> HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
> HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache
> --
> 2.53.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-31 12:04 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-13 20:39 [Buildroot] [PATCH v1 1/1] package/go: security bump to version 1.26.5 Christian Stewart via buildroot
2026-07-14 8:26 ` Julien Olivain via buildroot
2026-07-17 15:47 ` Thomas Perale via buildroot
2026-07-31 12:04 ` Thomas Perale via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox