Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package go1.26 for openSUSE:Factory checked in at 2026-11-11 16:25:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/go1.26 (Old) and /work/SRC/openSUSE:Factory/.go1.26.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "go1.26" Wed Nov 11 16:25:52 2026 rev:21 rq:1396634 version:1.26.11 Changes: -------- --- /work/SRC/openSUSE:Factory/go1.26/go1.26.changes 2026-10-21 20:54:24.749225590 +0200 +++ /work/SRC/openSUSE:Factory/.go1.26.new.3759290/go1.26.changes 2026-11-11 16:25:59.023517733 +0100 @@ -1,0 +2,32 @@ +Tue Nov 10 16:47:16 UTC 2026 - Jeff Kowalczyk <[email protected]> + +- go1.26.11 (released 2026-11-10) includes security fixes to cgo, + the go command, the compiler, the linker, and the net/http + package, as well as bug fixes to the assembler, the compiler, the + runtime, toolchain bootstrapping, and the crypto/fips140, + crypto/hkdf, crypto/rsa, crypto/tls, net, and net/http packages. + Refs boo#1255111 go1.26 release tracking + CVE-2026-97033 CVE-2026-97034 CVE-2026-97035 CVE-2026-97036 CVE-2026-97037 CVE-2026-97038 CVE-2026-97039 CVE-2026-97040 CVE-2026-97041 CVE-2026-97042 CVE-2026-97043 CVE-2026-97054 + * go#82599 go#82577 boo#1289978 security: fix CVE-2026-97033 cmd/go: unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags + * go#82597 go#82576 boo#1289979 security: fix CVE-2026-97034 cmd/go: arbitrary command execution via GCC spec files in cgo linker search directories + * go#82595 go#82575 boo#1289980 security: fix CVE-2026-97035 cmd/go: unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo + * go#82593 go#82574 boo#1289981 security: fix CVE-2026-97036 cmd/go: arbitrary code execution during build on darwin via "-l to_library" in cgo + * go#82591 go#82573 boo#1289982 security: fix CVE-2026-97037 cmd/go: linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo + * go#82589 go#82572 boo#1289983 security: fix CVE-2026-97038 cmd/go: arbitrary code execution via crafted .syso files and cgo linker input files + * go#82587 go#82571 boo#1289984 security: fix CVE-2026-97039 cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives + * go#82585 go#82570 boo#1289985 security: fix CVE-2026-97040 cmd/go, cmd/link: cgo directive injection via .syso files disguised as Go object files + * go#82583 go#82569 boo#1289986 security: fix CVE-2026-97041 cmd/compile, cmd/link: host linker flag injection via //go:cgo_* directives + * go#82581 go#82568 boo#1289987 security: fix CVE-2026-97042 cmd/cgo, cmd/compile, cmd/link: linker flag injection via cgo_import_dynamic and PE DLL names + * go#82579 go#82567 boo#1289988 security: fix CVE-2026-97043 cmd/go, cmd/compile: unexpected code execution via escaped quotes in //go:cgo_ldflag + * go#82564 go#82563 boo#1289989 security: fix CVE-2026-97054 net/http: HTTP/1 server crash due to MaxBytesReader header race + * go#81865 cmd/compile: branchelim optimization can eliminate result of store + * go#81869 cmd/compile: generic shift-by-constant canonicalization gives Const64 the wrong type + * go#81926 cmd/asm: amd64 assembler loops forever on a forward jump to a labelled PCALIGN when a branch needs widening + * go#81946 net/http: backport fix to protect against middleware changing server response body + * go#82022 net: Dialer.Dial{TCP,UDP,IP} incorrectly treats invalid addresses as :: + * go#82149 runtime: linux/mips time64 nanosecond layout causes busy waits and empty CPU profiles + * go#82333 cmd/dist: GOFIPS140 bootstrap from Go 1.26 fails + * go#82626 crypto/fips140: minor compliance improvements + * go#82642 cmd/compile: ICE on 386 when inlining nested bit rotations (Int64Lo not lowered) + +------------------------------------------------------------------- Old: ---- go1.26.10.src.tar.gz New: ---- go1.26.11.src.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ go1.26.spec ++++++ --- /var/tmp/diff_new_pack.ZZk4mM/_old 2026-11-11 16:26:00.116563573 +0100 +++ /var/tmp/diff_new_pack.ZZk4mM/_new 2026-11-11 16:26:00.117563615 +0100 @@ -96,7 +96,7 @@ %endif Name: go1.26 -Version: 1.26.10 +Version: 1.26.11 Release: 0 Summary: A compiled, garbage-collected, concurrent programming language License: BSD-3-Clause ++++++ go1.26.10.src.tar.gz -> go1.26.11.src.tar.gz ++++++ /work/SRC/openSUSE:Factory/go1.26/go1.26.10.src.tar.gz /work/SRC/openSUSE:Factory/.go1.26.new.3759290/go1.26.11.src.tar.gz differ: char 17, line 1
