* Fri Aug 08 2025 jkowalczyk@suse.com
- Packaging improvements:
* Update go_bootstrap_version to go1.21 from go1.20 to shorten
the bootstrap chain. go1.21 can optionally be bootstrapped with
gccgo and serve as the inital version of go1.x.
* Refs boo#1247816 bootstrap go1.21 with gccgo
* Tue Feb 04 2025 jkowalczyk@suse.com
- go1.22.12 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler and
the go command.
Refs boo#1218424 go1.22 release tracking
CVE-2025-22866
* go#71422 go#71383 boo#1236801 security: fix CVE-2025-22866 crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le
* go#71262 cmd/go/internal/modfetch/codehost: test fails with git 2.47.1
* go#71229 cmd/compile: broken write barrier
* Thu Jan 16 2025 jkowalczyk@suse.com
- go1.22.11 (released 2025-01-16) includes security fixes to the
crypto/x509 and net/http packages, as well as bug fixes to the
runtime.
Refs boo#1218424 go1.22 release tracking
CVE-2024-45341 CVE-2024-45336
* go#71207 go#71156 boo#1236045 security: fix CVE-2024-45341 crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints
* go#71210 go#70530 boo#1236046 security: fix CVE-2024-45336 net/http: sensitive headers incorrectly sent after cross-domain redirect
* go#71103 crypto/tls: TestVerifyConnection/TLSv12 failures
* go#71146 internal/trace: TestTraceCPUProfile/Stress failures
* Thu Dec 05 2024 adrian@suse.de
- Enable loongarch64 builds
* Tue Dec 03 2024 jkowalczyk@suse.com
- go1.22.10 (released 2024-12-03) includes fixes to the runtime and
the syscall package.
Refs boo#1218424 go1.22 release tracking
* go#70201 syscall: SyscallN always escapes the variadic argument
* go#70238 time: TestLoadFixed failures
* go#70474 sync/atomic: TestNilDeref flaky failure on windows-386 with runtime fatal error
* Wed Nov 06 2024 jkowalczyk@suse.com
- go1.22.9 (released 2024-11-06) includes fixes to the linker.
Refs boo#1218424 go1.22 release tracking
* go#69745 runtime: TestGdbAutotmpTypes failures
* go#69991 cmd/link: LC_UUID not generated by go linker, resulting in failure to access local network on macOS 15
* go#70124 cmd/cgo/internal/testcarchive: TestManyCalls failures
* Tue Oct 01 2024 jkowalczyk@suse.com
- go1.22.8 (released 2024-10-01) includes fixes to cgo, and the
maps and syscall packages.
Refs boo#1218424 go1.22 release tracking
* go#69155 maps: segmentation violation in maps.Clone
* go#69218 cmd/cgo: alignment issue with int128 inside of a struct
* go#69366 syscall: TestAmbientCapsUserns fails on Ubuntu 24.04/Linux 6.8.0
* Thu Sep 05 2024 jkowalczyk@suse.com
- go1.22.7 (released 2024-09-05) includes security fixes to the
encoding/gob, go/build/constraint, and go/parser packages, as
well as bug fixes to the fix command and the runtime.
Refs boo#1218424 go1.22 release tracking
CVE-2024-34155 CVE-2024-34156 CVE-2024-34158
- go#69142 go#69138 boo#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)
- go#69144 go#69139 boo#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)
- go#69148 go#69141 boo#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)
- go#68811 os: TestChtimes failures
- go#68825 cmd/fix: fails to run on modules whose go directive value is in "1.n.m" format introduced in Go 1.21.0
- go#68972 cmd/cgo: aix c-archive corrupting stack
* Tue Aug 06 2024 jkowalczyk@suse.com
- go1.22.6 (released 2024-08-06) includes fixes to the go command,
the compiler, the linker, the trace command, the covdata command,
and the bytes, go/types, and os/exec packages.
Refs boo#1218424 go1.22 release tracking
* go#68594 cmd/compile: internal compiler error with zero-size types
* go#68546 cmd/trace/v2: pprof profiles always empty
* go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop
* go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm
* go#68370 go/types: assertion failure in recent range statement checking logic
* go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows
* go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race
* go#68222 cmd/go: list with -export and -covermode=atomic fails to build
* go#68198 cmd/link: issues with Xcode 16 beta
* Tue Jul 02 2024 jkowalczyk@suse.com
- go1.22.5 (released 2024-07-02) includes security fixes to the
net/http package, as well as bug fixes to the compiler, cgo, the
go command, the linker, the runtime, and the crypto/tls,
go/types, net, net/http, and os/exec packages.
Refs boo#1218424 go1.22 release tracking
CVE-2024-24791
* go#68200 go#67555 boo#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways
* go#65983 cmd/compile: hash of unhashable type
* go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()
* go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without ".exe" no longer implicitly adds ".exe" in Go 1.22
* go#67298 runtime: "fatal: morestack on g0" on amd64 after upgrade to Go 1.21, stale bounds
* go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders
* go#67798 cmd/compile: internal compiler error: unexpected type: <nil> (<nil>) in for-range
* go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec
* go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0
* go#67934 net: go DNS resolver fails to connect to local DNS server
* go#67945 cmd/link: using -fuzz with test that links with cgo on darwin causes linker failure
* go#68052 cmd/go: go list -u -m all fails loading module retractions: module requires go >= 1.N+1 (running go 1.N)
* go#68122 cmd/link: runtime.mach_vm_region_trampoline: unsupported dynamic relocation for symbol libc_mach_task_self_ (type=29 (R_GOTPCREL) stype=46 (SDYNIMPORT))