From 1b5a7bb021e92a1faf528c5f59dbd7b114bcf108 Mon Sep 17 00:00:00 2001 From: Christian Stewart Date: Thu, 9 Apr 2026 21:33:08 -0700 Subject: [PATCH] package/go: security bump to version 1.26.2 go1.26.2 (released 2026-04-07) includes security fixes to the go command, the compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os packages, as well as bug fixes to the go command, the go fix command, the compiler, the linker, the runtime, and the net, net/http, and net/url packages. CVE-2026-32289: html/template: JS template literal context incorrectly tracked CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG CVE-2026-32280: crypto/x509: unexpected work during chain building CVE-2026-32281: crypto/x509: inefficient policy validation https://go.dev/doc/devel/release#go1.26.2 https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved Signed-off-by: Christian Stewart [Julien: add "security" in commit log title] Signed-off-by: Julien Olivain (cherry picked from commit 82518f8cb41f1377b7a65abc659adc96ffcbe05b) Signed-off-by: Thomas Perale --- package/go/go.hash | 14 +++++++------- package/go/go.mk | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package/go/go.hash b/package/go/go.hash index bae223882a..77be843c83 100644 --- a/package/go/go.hash +++ b/package/go/go.hash @@ -1,9 +1,9 @@ # sha256 checksum from https://go.dev/dl/ -sha256 3172293d04b209dc1144698e7ba13f0477f6ba8c5ffd0be66c20fdbc9785dfbb go1.26.1.src.tar.gz -sha256 da75d696c6b9440fe9fb6418429f29eaeee947707ee8c6ddb567c558051a1cc2 go1.26.1.linux-386.tar.gz -sha256 031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a go1.26.1.linux-amd64.tar.gz -sha256 a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7 go1.26.1.linux-arm64.tar.gz -sha256 c9937198994dc173b87630a94a0d323442bef81bf7589b1170d55a8ebf759bda go1.26.1.linux-armv6l.tar.gz -sha256 f56eed002998f5f51fa07fd4ed0c5de5e02d51cec7a4007f771c7576620d9d45 go1.26.1.linux-ppc64le.tar.gz -sha256 60fe623ef63e6338c055ec0e0e3f4fa85c97a056de2d2f6ee38591e2bfa9cdde go1.26.1.linux-s390x.tar.gz +sha256 2e91ebb6947a96e9436fb2b3926a8802efe63a6d375dffec4f82aa9dbd6fd43b go1.26.2.src.tar.gz +sha256 89835cdc4dfebde7fe28c9c6dc080bb3753f6b0354301966ff9f62d14991bd7d go1.26.2.linux-386.tar.gz +sha256 990e6b4bbba816dc3ee129eaeaf4b42f17c2800b88a2166c265ac1a200262282 go1.26.2.linux-amd64.tar.gz +sha256 c958a1fe1b361391db163a485e21f5f228142d6f8b584f6bef89b26f66dc5b23 go1.26.2.linux-arm64.tar.gz +sha256 0000e45577827b0a8868588c543cbe4232853def1d3d7a344ad6e60ce2b015c8 go1.26.2.linux-armv6l.tar.gz +sha256 62b7645dd2404052535617c59e91cf03c7aa28e332dbaddbe4c0d7de7bcc6736 go1.26.2.linux-ppc64le.tar.gz +sha256 410726ed10a0ea6745c2ea8da4f0e769fd3ce819cd4a41a67ad08b094d5dfc31 go1.26.2.linux-s390x.tar.gz sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE diff --git a/package/go/go.mk b/package/go/go.mk index 6c57be0ad7..67948dc405 100644 --- a/package/go/go.mk +++ b/package/go/go.mk @@ -4,7 +4,7 @@ # ################################################################################ -GO_VERSION = 1.26.1 +GO_VERSION = 1.26.2 HOST_GO_GOPATH = $(HOST_DIR)/share/go-path HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache