Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package go1.27 for openSUSE:Factory checked in at 2026-11-13 20:12:20 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/go1.27 (Old) and /work/SRC/openSUSE:Factory/.go1.27.new.1251 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "go1.27" Fri Nov 13 20:12:20 2026 rev:7 rq:1396635 version:1.27.4 Changes: -------- --- /work/SRC/openSUSE:Factory/go1.27/go1.27.changes 2026-10-23 20:21:02.825367536 +0200 +++ /work/SRC/openSUSE:Factory/.go1.27.new.1251/go1.27.changes 2026-11-13 20:12:23.309563052 +0100 @@ -1,0 +2,32 @@ +Tue Nov 10 16:47:23 UTC 2026 - Jeff Kowalczyk <[email protected]> + +- go1.27.4 (released 2026-11-10) includes security fixes to cgo, + the go command, the compiler, the linker, and the net/http + package, as well as bug fixes to the assembler, the compiler, the + runtime, toolchain bootstrapping, and the crypto/fips140, + crypto/hkdf, crypto/rsa, crypto/tls, and net packages. + Refs boo#1272545 go1.27 release tracking + CVE-2026-97033 CVE-2026-97034 CVE-2026-97035 CVE-2026-97036 CVE-2026-97037 CVE-2026-97038 CVE-2026-97039 CVE-2026-97040 CVE-2026-97041 CVE-2026-97042 CVE-2026-97043 CVE-2026-97054 + * go#82600 go#82577 boo#1289978 security: fix CVE-2026-97033 cmd/go: unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags + * go#82598 go#82576 boo#1289979 security: fix CVE-2026-97034 cmd/go: arbitrary command execution via GCC spec files in cgo linker search directories + * go#82596 go#82575 boo#1289980 security: fix CVE-2026-97035 cmd/go: unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo + * go#82594 go#82574 boo#1289981 security: fix CVE-2026-97036 cmd/go: arbitrary code execution during build on darwin via "-l to_library" in cgo + * go#82592 go#82573 boo#1289982 security: fix CVE-2026-97037 cmd/go: linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo + * go#82590 go#82572 boo#1289983 security: fix CVE-2026-97038 cmd/go: arbitrary code execution via crafted .syso files and cgo linker input files + * go#82588 go#82571 boo#1289984 security: fix CVE-2026-97039 cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives + * go#82586 go#82570 boo#1289985 security: fix CVE-2026-97040 cmd/go, cmd/link: cgo directive injection via .syso files disguised as Go object files + * go#82584 go#82569 boo#1289986 security: fix CVE-2026-97041 cmd/compile, cmd/link: host linker flag injection via //go:cgo_* directives + * go#82582 go#82568 boo#1289987 security: fix CVE-2026-97042 cmd/cgo, cmd/compile, cmd/link: linker flag injection via cgo_import_dynamic and PE DLL names + * go#82580 go#82567 boo#1289988 security: fix CVE-2026-97043 cmd/go, cmd/compile: unexpected code execution via escaped quotes in //go:cgo_ldflag + * go#82565 go#82563 boo#1289989 security: fix CVE-2026-97054 net/http: HTTP/1 server crash due to MaxBytesReader header race + * go#81866 cmd/compile: branchelim optimization can eliminate result of store + * go#81927 cmd/asm: amd64 assembler loops forever on a forward jump to a labelled PCALIGN when a branch needs widening + * go#82023 net: Dialer.Dial{TCP,UDP,IP} incorrectly treats invalid addresses as :: + * go#82106 cmd/compile: staticcheck still crashes with generic methods on Go 1.27.2 + * go#82150 runtime: linux/mips time64 nanosecond layout causes busy waits and empty CPU profiles + * go#82334 cmd/dist: GOFIPS140 bootstrap from Go 1.26 fails + * go#82536 crypto/tls: omit ML-DSA from signature_algorithms_cert in Go 1.27CherryPickApproved + * go#82627 crypto/fips140: minor compliance improvements + * go#82657 runtime: nil-pointer panic in a promoted-method wrapper becomes "traceback did not unwind completely" under -race + +------------------------------------------------------------------- Old: ---- go1.27.3.src.tar.gz New: ---- go1.27.4.src.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ go1.27.spec ++++++ --- /var/tmp/diff_new_pack.Y9iVhf/_old 2026-11-13 20:12:24.624618717 +0100 +++ /var/tmp/diff_new_pack.Y9iVhf/_new 2026-11-13 20:12:24.629618929 +0100 @@ -96,7 +96,7 @@ %endif Name: go1.27 -Version: 1.27.3 +Version: 1.27.4 Release: 0 Summary: A compiled, garbage-collected, concurrent programming language License: BSD-3-Clause ++++++ go1.27.3.src.tar.gz -> go1.27.4.src.tar.gz ++++++ /work/SRC/openSUSE:Factory/go1.27/go1.27.3.src.tar.gz /work/SRC/openSUSE:Factory/.go1.27.new.1251/go1.27.4.src.tar.gz differ: char 114, line 1
