CVS commit: [pkgsrc-2026Q1] pkgsrc/lang

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: [pkgsrc-2026Q1] pkgsrc/lang
From: "Maya Rashish" <maya%netbsd.org@localhost>
Date: Wed, 22 Apr 2026 14:24:43 +0000

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Apr 22 14:24:43 UTC 2026

Modified Files:
        pkgsrc/lang/go [pkgsrc-2026Q1]: version.mk
        pkgsrc/lang/go125 [pkgsrc-2026Q1]: PLIST distinfo
        pkgsrc/lang/go126 [pkgsrc-2026Q1]: PLIST distinfo

Log Message:
Pullup ticket #7080 - requested by bsiegert
lang/go125: Security fix
lang/go126: Security fix

Revisions pulled up:
- lang/go/version.mk                                            1.247
- lang/go125/PLIST                                              1.6
- lang/go125/distinfo                                           1.11
- lang/go126/PLIST                                              1.3
- lang/go126/distinfo                                           1.3

---
   Module Name:    pkgsrc
   Committed By:   bsiegert
   Date:           Wed Apr  8 05:43:35 UTC 2026

   Modified Files:
           pkgsrc/lang/go: version.mk
           pkgsrc/lang/go125: PLIST distinfo
           pkgsrc/lang/go126: PLIST distinfo

   Log Message:
   go: update to 1.25.9 and 1.26.2 (security).

   These releases include 10 security fixes following the security policy
   <https://go.dev/doc/security/policy>:

   - os: Root.Chmod can follow symlinks out of the root on Linux

     On Linux, if the target of Root.Chmod is replaced with a symlink while
     the chmod operation is in progress, Chmod could operate on the target
     of the symlink, even when the target lies outside the root.

     The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag,
     which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its
     target before acting and returns an error if the target is a symlink
     lying outside the root, so the impact is limited to cases where the
     target is replaced with a symlink between the check and operation.

     On Linux, Root.Chmod now uses the fchmodat2 syscall when available, and
     an workaround using /proc/self/fd otherwise.

     Thanks to Uuganbayar Lkhamsuren for reporting this issue.

     This is CVE-2026-32282 and Go issue https://go.dev/issue/78293.

   - html/template: JS template literal context incorrectly tracked

     Context was not properly tracked across template branches for JS
     template literals, leading to possibly incorrect escaping of content
     when branches were used.

     Additionally template actions within JS template literals did not
     properly track the brace depth, leading to incorrect escaping being
     applied.

     These issues could cause actions within JS template literals to be
     incorrectly or improperly escaped, leading to XSS vulnerabilities.

     This only affects templates that use template actions within JS
     template literals.

     This is CVE-2026-32289 and Go issue https://go.dev/issue/78331.

   - crypto/x509: excluded DNS constraints not properly applied to wildcard
     domains

     When verifying a certificate chain containing excluded DNS
     constraints, these constraints are not correctly applied to wildcard
     DNS SANs which use a different case than the constraint.

     For example, if a certificate contains the DNS name "*.example.com"
     and the excluded DNS name "EXAMPLE.COM", the constraint will not be
     applied.

     This only affects validation of otherwise trusted certificate chains,
     issued by a root CA in the VerifyOptions.Roots CertPool, or in the
     system certificate pool.

     This issue only affects Go 1.26.

     Thank you to Riyas from Saintgits College of Engineering, k1rnt,
     @1seal for reporting this issue.

     This is CVE-2026-33810 and Go issue https://go.dev/issue/78332.

   - cmd/compile: no-op interface conversion bypasses overlap checking

     Previously, the compiler failed to unwrap pointers contained within
     a no-op interface conversion leading to an incorrect determination
     of a non-overlapping move.

     To prevent unsafe move operations, the compiler will now unwrap all
     such conversions before considering a move non-overlapping.

     Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

     This is CVE-2026-27144 and Go issue https://go.dev/issue/78371.

   - cmd/compile: possible memory corruption after bound check elimination

     Previously, slices and arrays accessed using induction variables
     were sometimes incorrectly proved in-bound. If the induction variable
     used for indexing were to overflow or underflow, it could allow access
     to memory beyond the scope of the original slice or array.

     To prevent this behavior, the compiler ensures that any mutated induction
     variable that overflows/underflows with respect to its loop condition
     is not used for bound check elimination.

     Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

     This is CVE-2026-27143 and Go issue https://go.dev/issue/78333.

   - archive/tar: unbounded allocation when parsing old format GNU sparse map

     tar.Reader could allocate an unbounded amount of memory when reading
     a maliciously-crafted archive containing a large number of sparse
     regions encoded in the "old GNU sparse map" format.

     We now limit both the number of old GNU sparse map extension blocks,
     and the total number of sparse file entries, regardless of encoding.

     Thanks to Colin Walters (walters%verbum.org@localhost) who initially reported
     this issue. Thanks also to Uuganbayar Lkhamsuren
     (https://github.com/uug4na) and Jakub Ciolek
     who additionally reported this issue.

     This is CVE-2026-32288 and Go issue https://go.dev/issue/78301.

   - crypto/tls: multiple key update handshake messages can cause
     connection to deadlock

     If one side of the TLS connection sends multiple key update messages
     post-handshake in a single record, the connection can deadlock, causing
     uncontrolled consumption of resources. This can lead to a denial of servi=
   ce.

     This only affects TLS 1.3.

     Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

     This is CVE-2026-32283 and Go issue https://go.dev/issue/78334.

   - cmd/go: trust layer bypass when using cgo and SWIG

     A well-crafted SWIG source file could take advantage
     of a file-naming convention used inside the trust
     boundary of the cgo compiler. Doing so could result
     in arbitrary code execution during build time.

     SWIG files are disallowed from using this convention.

     Thank you to Juho Fors=C3=A9n of Mattermost for reporting this issue.

     This is CVE-2026-27140 and Go issue https://go.dev/issue/78335.

   - crypto/x509: unexpected work during chain building

     During chain building, the amount of work that is done is not
     correctly limited when a large number of intermediate certificates are
     passed in VerifyOptions.Intermediates, which can lead to a denial of
     service. This affects both direct users of crypto/x509 and users of
     crypto/tls.

     Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

     This is CVE-2026-32280 and Go issue https://go.dev/issue/78282.

   - crypto/x509: inefficient policy validation

     Validating certificate chains which use policies is unexpectedly
     inefficient when certificates in the chain contain a very large number
     of policy mappings, possibly causing denial of service.

     This only affects validation of otherwise trusted certificate chains,
     issued by a root CA in the VerifyOptions.Roots CertPool, or in the
     system certificate pool.

     Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

     This is CVE-2026-32281 and Go issue https://go.dev/issue/78281.


To generate a diff of this commit:
cvs rdiff -u -r1.246 -r1.246.2.1 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.5 -r1.5.2.1 pkgsrc/lang/go125/PLIST
cvs rdiff -u -r1.10 -r1.10.2.1 pkgsrc/lang/go125/distinfo
cvs rdiff -u -r1.2 -r1.2.2.1 pkgsrc/lang/go126/PLIST \
    pkgsrc/lang/go126/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.246 pkgsrc/lang/go/version.mk:1.246.2.1
--- pkgsrc/lang/go/version.mk:1.246     Fri Mar  6 20:57:33 2026
+++ pkgsrc/lang/go/version.mk   Wed Apr 22 14:24:43 2026
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.246 2026/03/06 20:57:33 bsiegert Exp $
+# $NetBSD: version.mk,v 1.246.2.1 2026/04/22 14:24:43 maya Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -6,8 +6,8 @@
 #
 .include "go-vars.mk"
 
-GO126_VERSION= 1.26.1
-GO125_VERSION= 1.25.8
+GO126_VERSION= 1.26.2
+GO125_VERSION= 1.25.9
 GO124_VERSION= 1.24.13
 GO123_VERSION= 1.23.12
 GO122_VERSION= 1.22.12

Index: pkgsrc/lang/go125/PLIST
diff -u pkgsrc/lang/go125/PLIST:1.5 pkgsrc/lang/go125/PLIST:1.5.2.1
--- pkgsrc/lang/go125/PLIST:1.5 Fri Mar  6 20:57:33 2026
+++ pkgsrc/lang/go125/PLIST     Wed Apr 22 14:24:43 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.5 2026/03/06 20:57:33 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.5.2.1 2026/04/22 14:24:43 maya Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go125/CONTRIBUTING.md
@@ -1255,6 +1255,7 @@ go125/src/cmd/compile/internal/test/loca
 go125/src/cmd/compile/internal/test/logic_test.go
 go125/src/cmd/compile/internal/test/math_test.go
 go125/src/cmd/compile/internal/test/memcombine_test.go
+go125/src/cmd/compile/internal/test/memoverlap_test.go
 go125/src/cmd/compile/internal/test/mergelocals_test.go
 go125/src/cmd/compile/internal/test/mulconst_test.go
 go125/src/cmd/compile/internal/test/pgo_devirtualize_test.go
@@ -7502,6 +7503,9 @@ go125/src/internal/syscall/unix/faccessa
 go125/src/internal/syscall/unix/fallocate_freebsd_386.go
 go125/src/internal/syscall/unix/fallocate_freebsd_64bit.go
 go125/src/internal/syscall/unix/fallocate_freebsd_arm.go
+go125/src/internal/syscall/unix/fchmodat_linux.go
+go125/src/internal/syscall/unix/fchmodat_other.go
+go125/src/internal/syscall/unix/fchmodat_test.go
 go125/src/internal/syscall/unix/fcntl_js.go
 go125/src/internal/syscall/unix/fcntl_unix.go
 go125/src/internal/syscall/unix/fcntl_wasip1.go
@@ -9815,23 +9819,32 @@ go125/src/runtime/race.go
 go125/src/runtime/race/README
 go125/src/runtime/race/doc.go
 go125/src/runtime/race/internal/amd64v1/doc.go
+go125/src/runtime/race/internal/amd64v1/race_darwin.patch
 go125/src/runtime/race/internal/amd64v1/race_darwin.syso
+go125/src/runtime/race/internal/amd64v1/race_freebsd.patch
 go125/src/runtime/race/internal/amd64v1/race_freebsd.syso
+go125/src/runtime/race/internal/amd64v1/race_linux.patch
 go125/src/runtime/race/internal/amd64v1/race_linux.syso
 go125/src/runtime/race/internal/amd64v1/race_netbsd.syso
 go125/src/runtime/race/internal/amd64v1/race_openbsd.syso
+go125/src/runtime/race/internal/amd64v1/race_windows.patch
 go125/src/runtime/race/internal/amd64v1/race_windows.syso
 go125/src/runtime/race/internal/amd64v3/doc.go
+go125/src/runtime/race/internal/amd64v3/race_linux.patch
 go125/src/runtime/race/internal/amd64v3/race_linux.syso
 go125/src/runtime/race/mkcgo.sh
 go125/src/runtime/race/output_test.go
 go125/src/runtime/race/race.go
 go125/src/runtime/race/race_darwin_amd64.go
 go125/src/runtime/race/race_darwin_arm64.go
+go125/src/runtime/race/race_darwin_arm64.patch
 go125/src/runtime/race/race_darwin_arm64.syso
+go125/src/runtime/race/race_linux_arm64.patch
 go125/src/runtime/race/race_linux_arm64.syso
+go125/src/runtime/race/race_linux_loong64.patch
 go125/src/runtime/race/race_linux_loong64.syso
 go125/src/runtime/race/race_linux_ppc64le.syso
+go125/src/runtime/race/race_linux_s390x.patch
 go125/src/runtime/race/race_linux_s390x.syso
 go125/src/runtime/race/race_linux_test.go
 go125/src/runtime/race/race_test.go
@@ -13597,6 +13610,7 @@ go125/test/fixedbugs/issue7740.go
 go125/test/fixedbugs/issue7742.go
 go125/test/fixedbugs/issue7746.go
 go125/test/fixedbugs/issue7760.go
+go125/test/fixedbugs/issue77919.go
 go125/test/fixedbugs/issue7794.go
 go125/test/fixedbugs/issue7863.go
 go125/test/fixedbugs/issue7867.go

Index: pkgsrc/lang/go125/distinfo
diff -u pkgsrc/lang/go125/distinfo:1.10 pkgsrc/lang/go125/distinfo:1.10.2.1
--- pkgsrc/lang/go125/distinfo:1.10     Fri Mar  6 20:57:34 2026
+++ pkgsrc/lang/go125/distinfo  Wed Apr 22 14:24:43 2026
@@ -1,11 +1,11 @@
-$NetBSD: distinfo,v 1.10 2026/03/06 20:57:34 bsiegert Exp $
+$NetBSD: distinfo,v 1.10.2.1 2026/04/22 14:24:43 maya Exp $
 
 BLAKE2s (9ba0948172cbb05308fb2a9db823a720f8ffb9ad.patch) = e1cc8b23dd53ddb2e0d034b15afda2c5f83a5103a9536fd54d717b07f5fd9628
 SHA512 (9ba0948172cbb05308fb2a9db823a720f8ffb9ad.patch) = 0a0787b8ea302356b724c36baf0db0df4ba29e5c56a6facc7d5a86d159dd6de23817ca62c3446f7e134810b44ebd79b6758331630e2ba8b196e6b249f1871d33
 Size (9ba0948172cbb05308fb2a9db823a720f8ffb9ad.patch) = 1661 bytes
-BLAKE2s (go1.25.8.src.tar.gz) = e9882b64493cf3f5eca80739862a90e9bda9d43f67f40d423de9070367d10036
-SHA512 (go1.25.8.src.tar.gz) = 2f5c9f314d18169985a9a4b19346e00dd5d4b396c8c17bfffe5719e51f27d834cc9649d0165f7eeb7367d3b6d384f49917325a40b49ba4da65e22f2c5362c739
-Size (go1.25.8.src.tar.gz) = 31991986 bytes
+BLAKE2s (go1.25.9.src.tar.gz) = cb6479fc548f1786addd2758c263d1f978fcdd7a123fd4b9089aa70dd3395b4c
+SHA512 (go1.25.9.src.tar.gz) = b1a89da9f53db56f59716814adf412f10fcb7e72aa9fa0df216ad7200082731f18b449bc669d340f59b80355e66a6e2f156567a45ffd2e138df45bf8bce8dd8f
+Size (go1.25.9.src.tar.gz) = 31997830 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35

Index: pkgsrc/lang/go126/PLIST
diff -u pkgsrc/lang/go126/PLIST:1.2 pkgsrc/lang/go126/PLIST:1.2.2.1
--- pkgsrc/lang/go126/PLIST:1.2 Fri Mar  6 20:57:34 2026
+++ pkgsrc/lang/go126/PLIST     Wed Apr 22 14:24:43 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.2 2026/03/06 20:57:34 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.2.2.1 2026/04/22 14:24:43 maya Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go126/CONTRIBUTING.md
@@ -1296,6 +1296,7 @@ go126/src/cmd/compile/internal/test/loca
 go126/src/cmd/compile/internal/test/logic_test.go
 go126/src/cmd/compile/internal/test/math_test.go
 go126/src/cmd/compile/internal/test/memcombine_test.go
+go126/src/cmd/compile/internal/test/memoverlap_test.go
 go126/src/cmd/compile/internal/test/mergelocals_test.go
 go126/src/cmd/compile/internal/test/move_test.go
 go126/src/cmd/compile/internal/test/mulconst_test.go
@@ -7741,6 +7742,9 @@ go126/src/internal/syscall/unix/faccessa
 go126/src/internal/syscall/unix/fallocate_bsd_386.go
 go126/src/internal/syscall/unix/fallocate_bsd_64bit.go
 go126/src/internal/syscall/unix/fallocate_bsd_arm.go
+go126/src/internal/syscall/unix/fchmodat_linux.go
+go126/src/internal/syscall/unix/fchmodat_other.go
+go126/src/internal/syscall/unix/fchmodat_test.go
 go126/src/internal/syscall/unix/fcntl_js.go
 go126/src/internal/syscall/unix/fcntl_unix.go
 go126/src/internal/syscall/unix/fcntl_wasip1.go
@@ -10073,6 +10077,7 @@ go126/src/runtime/preempt_wasm.s
 go126/src/runtime/preempt_xreg.go
 go126/src/runtime/print.go
 go126/src/runtime/print_quoted_test.go
+go126/src/runtime/print_test.go
 go126/src/runtime/proc.go
 go126/src/runtime/proc_runtime_test.go
 go126/src/runtime/proc_test.go
@@ -10083,24 +10088,33 @@ go126/src/runtime/race.go
 go126/src/runtime/race/README
 go126/src/runtime/race/doc.go
 go126/src/runtime/race/internal/amd64v1/doc.go
+go126/src/runtime/race/internal/amd64v1/race_darwin.patch
 go126/src/runtime/race/internal/amd64v1/race_darwin.syso
+go126/src/runtime/race/internal/amd64v1/race_freebsd.patch
 go126/src/runtime/race/internal/amd64v1/race_freebsd.syso
+go126/src/runtime/race/internal/amd64v1/race_linux.patch
 go126/src/runtime/race/internal/amd64v1/race_linux.syso
 go126/src/runtime/race/internal/amd64v1/race_netbsd.syso
 go126/src/runtime/race/internal/amd64v1/race_openbsd.syso
+go126/src/runtime/race/internal/amd64v1/race_windows.patch
 go126/src/runtime/race/internal/amd64v1/race_windows.syso
 go126/src/runtime/race/internal/amd64v3/doc.go
+go126/src/runtime/race/internal/amd64v3/race_linux.patch
 go126/src/runtime/race/internal/amd64v3/race_linux.syso
 go126/src/runtime/race/mkcgo.sh
 go126/src/runtime/race/output_test.go
 go126/src/runtime/race/race.go
 go126/src/runtime/race/race_darwin_amd64.go
 go126/src/runtime/race/race_darwin_arm64.go
+go126/src/runtime/race/race_darwin_arm64.patch
 go126/src/runtime/race/race_darwin_arm64.syso
+go126/src/runtime/race/race_linux_arm64.patch
 go126/src/runtime/race/race_linux_arm64.syso
+go126/src/runtime/race/race_linux_loong64.patch
 go126/src/runtime/race/race_linux_loong64.syso
 go126/src/runtime/race/race_linux_ppc64le.syso
 go126/src/runtime/race/race_linux_riscv64.syso
+go126/src/runtime/race/race_linux_s390x.patch
 go126/src/runtime/race/race_linux_s390x.syso
 go126/src/runtime/race/race_linux_test.go
 go126/src/runtime/race/race_test.go
@@ -14078,7 +14092,11 @@ go126/test/fixedbugs/issue77534.go
 go126/test/fixedbugs/issue7760.go
 go126/test/fixedbugs/issue77604.go
 go126/test/fixedbugs/issue77613.go
+go126/test/fixedbugs/issue77635.go
+go126/test/fixedbugs/issue77635b.go
 go126/test/fixedbugs/issue77779.go
+go126/test/fixedbugs/issue77815.go
+go126/test/fixedbugs/issue77919.go
 go126/test/fixedbugs/issue7794.go
 go126/test/fixedbugs/issue7863.go
 go126/test/fixedbugs/issue7867.go
Index: pkgsrc/lang/go126/distinfo
diff -u pkgsrc/lang/go126/distinfo:1.2 pkgsrc/lang/go126/distinfo:1.2.2.1
--- pkgsrc/lang/go126/distinfo:1.2      Fri Mar  6 20:57:34 2026
+++ pkgsrc/lang/go126/distinfo  Wed Apr 22 14:24:43 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.2 2026/03/06 20:57:34 bsiegert Exp $
+$NetBSD: distinfo,v 1.2.2.1 2026/04/22 14:24:43 maya Exp $
 
-BLAKE2s (go1.26.1.src.tar.gz) = f7d0d40cf99b132681c8736887316d983c43cee225fefe48e0f58b9e47b75481
-SHA512 (go1.26.1.src.tar.gz) = 7bab2a762b4aff1c2c3a3cf3ad20bce63fabff28c7ff63b18cb8b0ce427a7bc1781cfd3fa291f4bff499247b1f0fd56f1698bb19bc7c1be7d7d2f38716438d41
-Size (go1.26.1.src.tar.gz) = 34108253 bytes
+BLAKE2s (go1.26.2.src.tar.gz) = ddc192dfd3d64112040448bce9d23d785ae50636826f5201f7bd518ee78831ff
+SHA512 (go1.26.2.src.tar.gz) = 370773727c0e6fbf0acd534726938aaaa03ff785f0634c258c94a7a896e9a27acc0ba57120967f711a942e9e275cec46251a194d6f84ba15f28b5dcf0efed673
+Size (go1.26.2.src.tar.gz) = 34120738 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: [pkgsrc-2026Q1] pkgsrc
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: [pkgsrc-2026Q1] pkgsrc
Indexes:

Home | Main Index | Thread Index | Old Index