* [Buildroot] [PATCH v1 1/1] package/go: bump to version 1.26.2
@ 2026-04-10 4:33 Christian Stewart via buildroot
2026-04-10 12:04 ` Julien Olivain via buildroot
2026-04-17 15:24 ` Thomas Perale via buildroot
0 siblings, 2 replies; 3+ messages in thread
From: Christian Stewart via buildroot @ 2026-04-10 4:33 UTC (permalink / raw)
To: buildroot
Cc: Thomas Petazzoni, Julien Olivain, James Hilliard,
Christian Stewart, Thomas Perale
go1.26.2 (released 2026-04-07) includes security fixes to the go command, the
compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os
packages, as well as bug fixes to the go command, the go fix command, the
compiler, the linker, the runtime, and the net, net/http, and net/url packages.
CVE-2026-32289: html/template: JS template literal context incorrectly tracked
CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
CVE-2026-32280: crypto/x509: unexpected work during chain building
CVE-2026-32281: crypto/x509: inefficient policy validation
https://go.dev/doc/devel/release#go1.26.2
https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
Signed-off-by: Christian Stewart <christian@aperture.us>
---
package/go/go.hash | 14 +++++++-------
package/go/go.mk | 2 +-
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/package/go/go.hash b/package/go/go.hash
index bae223882a..77be843c83 100644
--- a/package/go/go.hash
+++ b/package/go/go.hash
@@ -1,9 +1,9 @@
# sha256 checksum from https://go.dev/dl/
-sha256 3172293d04b209dc1144698e7ba13f0477f6ba8c5ffd0be66c20fdbc9785dfbb go1.26.1.src.tar.gz
-sha256 da75d696c6b9440fe9fb6418429f29eaeee947707ee8c6ddb567c558051a1cc2 go1.26.1.linux-386.tar.gz
-sha256 031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a go1.26.1.linux-amd64.tar.gz
-sha256 a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7 go1.26.1.linux-arm64.tar.gz
-sha256 c9937198994dc173b87630a94a0d323442bef81bf7589b1170d55a8ebf759bda go1.26.1.linux-armv6l.tar.gz
-sha256 f56eed002998f5f51fa07fd4ed0c5de5e02d51cec7a4007f771c7576620d9d45 go1.26.1.linux-ppc64le.tar.gz
-sha256 60fe623ef63e6338c055ec0e0e3f4fa85c97a056de2d2f6ee38591e2bfa9cdde go1.26.1.linux-s390x.tar.gz
+sha256 2e91ebb6947a96e9436fb2b3926a8802efe63a6d375dffec4f82aa9dbd6fd43b go1.26.2.src.tar.gz
+sha256 89835cdc4dfebde7fe28c9c6dc080bb3753f6b0354301966ff9f62d14991bd7d go1.26.2.linux-386.tar.gz
+sha256 990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282 go1.26.2.linux-amd64.tar.gz
+sha256 c958a1fe1b361391db163a485e21f5f228142d6f8b584f6bef89b26f66dc5b23 go1.26.2.linux-arm64.tar.gz
+sha256 0000e45577827b0a8868588c543cbe4232853def1d3d7a344ad6e60ce2b015c8 go1.26.2.linux-armv6l.tar.gz
+sha256 62b7645dd2404052535617c59e91cf03c7aa28e332dbaddbe4c0d7de7bcc6736 go1.26.2.linux-ppc64le.tar.gz
+sha256 410726ed10a0ea6745c2ea8da4f0e769fd3ce819cd4a41a67ad08b094d5dfc31 go1.26.2.linux-s390x.tar.gz
sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE
diff --git a/package/go/go.mk b/package/go/go.mk
index 6c57be0ad7..67948dc405 100644
--- a/package/go/go.mk
+++ b/package/go/go.mk
@@ -4,7 +4,7 @@
#
################################################################################
-GO_VERSION = 1.26.1
+GO_VERSION = 1.26.2
HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache
--
2.53.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH v1 1/1] package/go: bump to version 1.26.2
2026-04-10 4:33 [Buildroot] [PATCH v1 1/1] package/go: bump to version 1.26.2 Christian Stewart via buildroot
@ 2026-04-10 12:04 ` Julien Olivain via buildroot
2026-04-17 15:24 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Julien Olivain via buildroot @ 2026-04-10 12:04 UTC (permalink / raw)
To: Christian Stewart
Cc: buildroot, Thomas Petazzoni, James Hilliard, Thomas Perale
On 10/04/2026 06:33, Christian Stewart via buildroot wrote:
> go1.26.2 (released 2026-04-07) includes security fixes to the go
> command, the
> compiler, and the archive/tar, crypto/tls, crypto/x509, html/template,
> and os
> packages, as well as bug fixes to the go command, the go fix command,
> the
> compiler, the linker, the runtime, and the net, net/http, and net/url
> packages.
>
> CVE-2026-32289: html/template: JS template literal context incorrectly
> tracked
> CVE-2026-33810: crypto/x509: excluded DNS constraints not properly
> applied to wildcard domains
> CVE-2026-27144: cmd/compile: no-op interface conversion bypasses
> overlap checking
> CVE-2026-27143: cmd/compile: possible memory corruption after bound
> check elimination
> CVE-2026-32288: archive/tar: unbounded allocation when parsing old
> format GNU sparse map
> CVE-2026-32283: crypto/tls: multiple key update handshake messages can
> cause connection to deadlock
> CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
> CVE-2026-32280: crypto/x509: unexpected work during chain building
> CVE-2026-32281: crypto/x509: inefficient policy validation
>
> https://go.dev/doc/devel/release#go1.26.2
> https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
>
> Signed-off-by: Christian Stewart <christian@aperture.us>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH v1 1/1] package/go: bump to version 1.26.2
2026-04-10 4:33 [Buildroot] [PATCH v1 1/1] package/go: bump to version 1.26.2 Christian Stewart via buildroot
2026-04-10 12:04 ` Julien Olivain via buildroot
@ 2026-04-17 15:24 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Perale via buildroot @ 2026-04-17 15:24 UTC (permalink / raw)
To: Christian Stewart; +Cc: Thomas Perale, buildroot
In reply of:
> go1.26.2 (released 2026-04-07) includes security fixes to the go command, the
> compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os
> packages, as well as bug fixes to the go command, the go fix command, the
> compiler, the linker, the runtime, and the net, net/http, and net/url packages.
>
> CVE-2026-32289: html/template: JS template literal context incorrectly tracked
> CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
> CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
> CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
> CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
> CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
> CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
> CVE-2026-32280: crypto/x509: unexpected work during chain building
> CVE-2026-32281: crypto/x509: inefficient policy validation
>
> https://go.dev/doc/devel/release#go1.26.2
> https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
>
> Signed-off-by: Christian Stewart <christian@aperture.us>
Applied to 2026.02.x. Thanks
> ---
> package/go/go.hash | 14 +++++++-------
> package/go/go.mk | 2 +-
> 2 files changed, 8 insertions(+), 8 deletions(-)
>
> diff --git a/package/go/go.hash b/package/go/go.hash
> index bae223882a..77be843c83 100644
> --- a/package/go/go.hash
> +++ b/package/go/go.hash
> @@ -1,9 +1,9 @@
> # sha256 checksum from https://go.dev/dl/
> -sha256 3172293d04b209dc1144698e7ba13f0477f6ba8c5ffd0be66c20fdbc9785dfbb go1.26.1.src.tar.gz
> -sha256 da75d696c6b9440fe9fb6418429f29eaeee947707ee8c6ddb567c558051a1cc2 go1.26.1.linux-386.tar.gz
> -sha256 031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a go1.26.1.linux-amd64.tar.gz
> -sha256 a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7 go1.26.1.linux-arm64.tar.gz
> -sha256 c9937198994dc173b87630a94a0d323442bef81bf7589b1170d55a8ebf759bda go1.26.1.linux-armv6l.tar.gz
> -sha256 f56eed002998f5f51fa07fd4ed0c5de5e02d51cec7a4007f771c7576620d9d45 go1.26.1.linux-ppc64le.tar.gz
> -sha256 60fe623ef63e6338c055ec0e0e3f4fa85c97a056de2d2f6ee38591e2bfa9cdde go1.26.1.linux-s390x.tar.gz
> +sha256 2e91ebb6947a96e9436fb2b3926a8802efe63a6d375dffec4f82aa9dbd6fd43b go1.26.2.src.tar.gz
> +sha256 89835cdc4dfebde7fe28c9c6dc080bb3753f6b0354301966ff9f62d14991bd7d go1.26.2.linux-386.tar.gz
> +sha256 990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282 go1.26.2.linux-amd64.tar.gz
> +sha256 c958a1fe1b361391db163a485e21f5f228142d6f8b584f6bef89b26f66dc5b23 go1.26.2.linux-arm64.tar.gz
> +sha256 0000e45577827b0a8868588c543cbe4232853def1d3d7a344ad6e60ce2b015c8 go1.26.2.linux-armv6l.tar.gz
> +sha256 62b7645dd2404052535617c59e91cf03c7aa28e332dbaddbe4c0d7de7bcc6736 go1.26.2.linux-ppc64le.tar.gz
> +sha256 410726ed10a0ea6745c2ea8da4f0e769fd3ce819cd4a41a67ad08b094d5dfc31 go1.26.2.linux-s390x.tar.gz
> sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE
> diff --git a/package/go/go.mk b/package/go/go.mk
> index 6c57be0ad7..67948dc405 100644
> --- a/package/go/go.mk
> +++ b/package/go/go.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -GO_VERSION = 1.26.1
> +GO_VERSION = 1.26.2
>
> HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
> HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache
> --
> 2.53.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-17 15:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-10 4:33 [Buildroot] [PATCH v1 1/1] package/go: bump to version 1.26.2 Christian Stewart via buildroot
2026-04-10 12:04 ` Julien Olivain via buildroot
2026-04-17 15:24 ` Thomas Perale via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox