CVS commit: pkgsrc/lang

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/lang
From: "Benny Siegert" <bsiegert%netbsd.org@localhost>
Date: Wed, 8 Jul 2026 18:31:12 +0000

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Wed Jul  8 18:31:11 UTC 2026

Modified Files:
        pkgsrc/lang/go: version.mk
        pkgsrc/lang/go125: PLIST distinfo
        pkgsrc/lang/go126: PLIST distinfo

Log Message:
go: update to 1.26.5 and 1.25.12 (security)

These releases include 2 security fixes following the security policy:

-   os: Root escape via symlink plus trailing slash

    On Unix systems, opening a file in an os.Root improperly
    followed symlinks to locations outside of the Root when
    the final path component of the a path is a symbolic link
    and the path ends in /.

    For example, root.Open("symlink/") would open "symlink" even when
    "symlink" is a symbolic link pointing outside of the root.

    On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
    in path when path ends in a /. Root failed to account for
    this behavior, permitting paths with a trailing / to escape.
    It now properly sanitizes the path parameter provided to openat.

    Thanks to Mundur (https://github.com/M0nd0R) for reporting this
    issue.

    This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.

-   crypto/tls: Encrypted Client Hello privacy leak

    The Encrypted Client Hello implementation would leak the pre-shared
    key identities during the handshake, allowing a passive network
    observer who can collect handshakes to de-anonymize the hostname of
    the server, even when ECH was being used.

    Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.

    This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.5


To generate a diff of this commit:
cvs rdiff -u -r1.250 -r1.251 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.8 -r1.9 pkgsrc/lang/go125/PLIST
cvs rdiff -u -r1.13 -r1.14 pkgsrc/lang/go125/distinfo
cvs rdiff -u -r1.5 -r1.6 pkgsrc/lang/go126/PLIST pkgsrc/lang/go126/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.250 pkgsrc/lang/go/version.mk:1.251
--- pkgsrc/lang/go/version.mk:1.250     Fri Jun  5 10:18:24 2026
+++ pkgsrc/lang/go/version.mk   Wed Jul  8 18:31:11 2026
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.250 2026/06/05 10:18:24 bsiegert Exp $
+# $NetBSD: version.mk,v 1.251 2026/07/08 18:31:11 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -6,8 +6,8 @@
 #
 .include "go-vars.mk"
 
-GO126_VERSION= 1.26.4
-GO125_VERSION= 1.25.11
+GO126_VERSION= 1.26.5
+GO125_VERSION= 1.25.12
 GO124_VERSION= 1.24.13
 GO123_VERSION= 1.23.12
 GO122_VERSION= 1.22.12

Index: pkgsrc/lang/go125/PLIST
diff -u pkgsrc/lang/go125/PLIST:1.8 pkgsrc/lang/go125/PLIST:1.9
--- pkgsrc/lang/go125/PLIST:1.8 Fri Jun  5 10:18:24 2026
+++ pkgsrc/lang/go125/PLIST     Wed Jul  8 18:31:11 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.8 2026/06/05 10:18:24 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.9 2026/07/08 18:31:11 bsiegert Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go125/CONTRIBUTING.md
@@ -1898,6 +1898,7 @@ go125/src/cmd/go/testdata/mod/example.co
 go125/src/cmd/go/testdata/mod/example.com_fuzzfail_v0.2.0.txt
 go125/src/cmd/go/testdata/mod/example.com_generics_v1.0.0.txt
 go125/src/cmd/go/testdata/mod/example.com_ignore_v1.0.0.txt
+go125/src/cmd/go/testdata/mod/example.com_importcrypto_v1.0.0.txt
 go125/src/cmd/go/testdata/mod/example.com_incompatiblewithsub_v1.0.0.txt
 go125/src/cmd/go/testdata/mod/example.com_incompatiblewithsub_v2.0.0+incompatible.txt
 go125/src/cmd/go/testdata/mod/example.com_invalidpath_v1_v1.0.0.txt
@@ -2501,6 +2502,7 @@ go125/src/cmd/go/testdata/script/mod_get
 go125/src/cmd/go/testdata/script/mod_get_exec_toolchain.txt
 go125/src/cmd/go/testdata/script/mod_get_extra.txt
 go125/src/cmd/go/testdata/script/mod_get_fallback.txt
+go125/src/cmd/go/testdata/script/mod_get_fips140_issue73649.txt
 go125/src/cmd/go/testdata/script/mod_get_fossil.txt
 go125/src/cmd/go/testdata/script/mod_get_future.txt
 go125/src/cmd/go/testdata/script/mod_get_go_file.txt
@@ -13624,6 +13626,7 @@ go125/test/fixedbugs/issue78641.go
 go125/test/fixedbugs/issue7867.go
 go125/test/fixedbugs/issue7884.go
 go125/test/fixedbugs/issue79182.go
+go125/test/fixedbugs/issue79186.go
 go125/test/fixedbugs/issue7921.go
 go125/test/fixedbugs/issue7944.go
 go125/test/fixedbugs/issue7995.go

Index: pkgsrc/lang/go125/distinfo
diff -u pkgsrc/lang/go125/distinfo:1.13 pkgsrc/lang/go125/distinfo:1.14
--- pkgsrc/lang/go125/distinfo:1.13     Fri Jun  5 10:18:24 2026
+++ pkgsrc/lang/go125/distinfo  Wed Jul  8 18:31:11 2026
@@ -1,11 +1,11 @@
-$NetBSD: distinfo,v 1.13 2026/06/05 10:18:24 bsiegert Exp $
+$NetBSD: distinfo,v 1.14 2026/07/08 18:31:11 bsiegert Exp $
 
 BLAKE2s (9ba0948172cbb05308fb2a9db823a720f8ffb9ad.patch) = e1cc8b23dd53ddb2e0d034b15afda2c5f83a5103a9536fd54d717b07f5fd9628
 SHA512 (9ba0948172cbb05308fb2a9db823a720f8ffb9ad.patch) = 0a0787b8ea302356b724c36baf0db0df4ba29e5c56a6facc7d5a86d159dd6de23817ca62c3446f7e134810b44ebd79b6758331630e2ba8b196e6b249f1871d33
 Size (9ba0948172cbb05308fb2a9db823a720f8ffb9ad.patch) = 1661 bytes
-BLAKE2s (go1.25.11.src.tar.gz) = c3d61476d3e97aad9a9be8a1dcc6f8aa5189c50fa6ef8e203db3db71899a7fb3
-SHA512 (go1.25.11.src.tar.gz) = d1fa0d267ee8ba55aacbe47562c128cccabb757dc1f5c553ac0fe70eec9edc49cf66133df6f88997c752e89f9d24b77bf4b6448f73fdd7d05f8bca88951eea26
-Size (go1.25.11.src.tar.gz) = 31999704 bytes
+BLAKE2s (go1.25.12.src.tar.gz) = 2650deb9f9fff8ec52466c156891bee279e71d178d9885c774bdcf3b0cc35ab9
+SHA512 (go1.25.12.src.tar.gz) = 748341d737c3ce9eb64a0f072c70be7cf3ceab7d1033da2d88b3aea4cf0de96745cded982b6db4a47de505c14e49babf59926fa61e6a86f2e22e61625daf762a
+Size (go1.25.12.src.tar.gz) = 32013699 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35

Index: pkgsrc/lang/go126/PLIST
diff -u pkgsrc/lang/go126/PLIST:1.5 pkgsrc/lang/go126/PLIST:1.6
--- pkgsrc/lang/go126/PLIST:1.5 Fri Jun  5 10:18:24 2026
+++ pkgsrc/lang/go126/PLIST     Wed Jul  8 18:31:11 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.5 2026/06/05 10:18:24 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.6 2026/07/08 18:31:11 bsiegert Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go126/CONTRIBUTING.md
@@ -1932,6 +1932,7 @@ go126/src/cmd/go/testdata/mod/example.co
 go126/src/cmd/go/testdata/mod/example.com_fuzzfail_v0.2.0.txt
 go126/src/cmd/go/testdata/mod/example.com_generics_v1.0.0.txt
 go126/src/cmd/go/testdata/mod/example.com_ignore_v1.0.0.txt
+go126/src/cmd/go/testdata/mod/example.com_importcrypto_v1.0.0.txt
 go126/src/cmd/go/testdata/mod/example.com_incompatiblewithsub_v1.0.0.txt
 go126/src/cmd/go/testdata/mod/example.com_incompatiblewithsub_v2.0.0+incompatible.txt
 go126/src/cmd/go/testdata/mod/example.com_invalidpath_v1_v1.0.0.txt
@@ -2543,6 +2544,7 @@ go126/src/cmd/go/testdata/script/mod_get
 go126/src/cmd/go/testdata/script/mod_get_exec_toolchain.txt
 go126/src/cmd/go/testdata/script/mod_get_extra.txt
 go126/src/cmd/go/testdata/script/mod_get_fallback.txt
+go126/src/cmd/go/testdata/script/mod_get_fips140_issue73649.txt
 go126/src/cmd/go/testdata/script/mod_get_fossil.txt
 go126/src/cmd/go/testdata/script/mod_get_future.txt
 go126/src/cmd/go/testdata/script/mod_get_go_file.txt
@@ -14114,6 +14116,7 @@ go126/test/fixedbugs/issue78641.go
 go126/test/fixedbugs/issue7867.go
 go126/test/fixedbugs/issue7884.go
 go126/test/fixedbugs/issue79182.go
+go126/test/fixedbugs/issue79186.go
 go126/test/fixedbugs/issue7921.go
 go126/test/fixedbugs/issue7944.go
 go126/test/fixedbugs/issue7995.go
@@ -14123,6 +14126,7 @@ go126/test/fixedbugs/issue7995b.go
 go126/test/fixedbugs/issue7996.go
 go126/test/fixedbugs/issue7997.go
 go126/test/fixedbugs/issue7998.go
+go126/test/fixedbugs/issue80004.go
 go126/test/fixedbugs/issue8004.go
 go126/test/fixedbugs/issue8011.go
 go126/test/fixedbugs/issue8017.go
Index: pkgsrc/lang/go126/distinfo
diff -u pkgsrc/lang/go126/distinfo:1.5 pkgsrc/lang/go126/distinfo:1.6
--- pkgsrc/lang/go126/distinfo:1.5      Fri Jun  5 10:18:24 2026
+++ pkgsrc/lang/go126/distinfo  Wed Jul  8 18:31:11 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.5 2026/06/05 10:18:24 bsiegert Exp $
+$NetBSD: distinfo,v 1.6 2026/07/08 18:31:11 bsiegert Exp $
 
-BLAKE2s (go1.26.4.src.tar.gz) = af9799bf289a45cb65b4327dad325d32abc1ffbc0a3fdedaf1f7bbcf10079b17
-SHA512 (go1.26.4.src.tar.gz) = adacc6a34ad239d98277acd2ac8da867110da0b184dbbafb82e8a06d2b7fd23434f878a8a8cd550172c21bd31ac6391d01a0bd095c9f5c1250be66b459c8de88
-Size (go1.26.4.src.tar.gz) = 34118246 bytes
+BLAKE2s (go1.26.5.src.tar.gz) = dea23908aed4269a49868ded2c57efdebd4628e98bd40916007b86db72f4e1e2
+SHA512 (go1.26.5.src.tar.gz) = 1c1ff7bc002438e77c968155b077c51df87935d1a1a214c8750e748abe3af5cf83769eae5cfe85ca1b12a0e6fa4a0dfe4344b1023f037f206dad328607bba9f7
+Size (go1.26.5.src.tar.gz) = 34140216 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc
Indexes:

Home | Main Index | Thread Index | Old Index