Re: [Buildroot] [PATCH v2 1/1] package/go: security bump to version 1.26.1

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Julien" == Julien Olivain via buildroot <buildroot@buildroot.org> writes:

 > On 12/03/2026 08:57, Christian Stewart via buildroot wrote:
 >> Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.
 >> To support this we use Go version 1.25.8 as the version for
 >> go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
 >> go-bootstrap-stage5.
 >> Go version 1.25.8 is the latest Go version we can build using
 >> go-bootstrap-stage4.
 >> The package build for go-bootstrap-stage5 is effectively identical
 >> to
 >> go-bootstrap-stage4 with only the Go version and stage number changed.
 >> Go 1.28 is expected to require a minor release of Go 1.26 for
 >> bootstrap.
 >> Fixes the following security vulnerabilities:
 >> - CVE-2026-25679: net/url: reject IPv6 literal not at start of host
 >> - CVE-2026-27142: html/template: URLs in meta attribute actions not
 >> escaped
 >> - CVE-2026-27137: crypto/x509: incorrect enforcement of email
 >> constraints
 >> - CVE-2026-27138: crypto/x509: panic in name constraint checking:
 >> certificates
 >> - CVE-2026-27139: os: FileInfo can escape from a Root
 >> For full release notes, see:
 >> https://go.dev/doc/devel/release#go1.26.0
 >> Signed-off-by: Christian Stewart <christian@aperture.us>

 > Applied to master, thanks.

NIT: It would have been better to first bump to 1.25.8 (which includes
the same security fixes) and then afterwards add the feature bump from
1.25.x to 1.26.x so the security fix could be backported.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot