* Thu Aug 14 2025 jkowalczyk@suse.com
- Packaging improvements:
* Remove conditional gccgo bootstrap sections and gcc-go.patch.
gccgo cannot be used in any version newer than go1.21. Removal
simplifies go1.x package code.
* go1.21 can optionally be bootstrapped with gccgo and serve as
the inital version of go1.x.
* go1.21 will be the initial version of Go in the bootstrap chain
until gcc gccgo is updated to support a language level newer
than go1.18.
* Drop gcc-go.patch
* Refs boo#1247816 bootstrap go1.21 with gccgo
* Refs boo#1248082 drop unused gccgo bootstrap code in go1.22+
* Mon Aug 11 2025 jkowalczyk@suse.com
- Update to version 1.23.12 cut from the go1.23-fips-release
branch at the revision tagged go1.23.12-1-openssl-fips.
Refs jsc#SLE-18320
* Rebase to 1.23.12
* Fix HKDF-Extract The latest OpenSSL in c9s/c10s requires nil
salt to be passed as a hash length buffer of zeros.
* Fri Aug 08 2025 jkowalczyk@suse.com
- Packaging improvements:
* Update go_bootstrap_version to go1.21 from go1.20 to shorten
the bootstrap chain. go1.21 can optionally be bootstrapped with
gccgo and serve as the inital version of go1.x.
* Refs boo#1247816 bootstrap go1.21 with gccgo
* Wed Aug 06 2025 jkowalczyk@suse.com
- go1.23.12 (released 2025-08-06) includes security fixes to the
database/sql and os/exec packages, as well as bug fixes to the
runtime.
Refs boo#1229122 go1.23 release tracking
CVE-2025-47906 CVE-2025-47907
* go#74803 go#74466 boo#1247719 security: fix CVE-2025-47906 os/exec: LookPath bug: incorrect expansion of "", "." and ".." in some PATH configurations
* go#74832 go#74831 boo#1247720 security: fix CVE-2025-47907 database/sql: incorrect results returned from Rows.Scan
* go#74415 runtime: use-after-free of allpSnapshot in findRunnable
* go#74693 runtime: segfaults in runtime.(*unwinder).next
* go#74721 cmd/go: TestScript/build_trimpath_cgo fails to decode dwarf on release-branch.go1.23
* go#74726 cmd/cgo/internal/testsanitizers: failures with signal: segmentation fault or exit status 66
* Thu Jul 31 2025 jkowalczyk@suse.com
- Update to version 1.23.11 cut from the go1.23-fips-release
branch at the revision tagged go1.23.11-1-openssl-fips.
Refs jsc#SLE-18320
* Rebase to 1.23.11
* Tue Jul 08 2025 jkowalczyk@suse.com
- go1.23.11 (released 2025-07-08) includes security fixes to the go
command, as well as bug fixes to the compiler, the linker, and
the runtime.
Refs boo#1229122 go1.23 release tracking
CVE-2025-4674
* go#74382 go#74380 boo#1246118 security: fix CVE-2025-4674 cmd/go: disable support for multiple vcs in one module
* go#73907 runtime: bad frame pointer during panic during duffcopy
* go#74289 runtime: heap mspan limit is set too late, causing data race between span allocation and conservative scanning
* go#74293 internal/trace: stress tests triggering suspected deadlock in tracer
* go#74362 runtime/pprof: crash "cannot read stack of running goroutine" in goroutine profile
* go#74402 cmd/link: duplicated definition of symbol github.com/ebitengine/purego.syscall15XABI0 when running with ASAN
* Fri Jun 06 2025 jkowalczyk@suse.com
- Update to version 1.23.10 cut from the go1.23-fips-release
branch at the revision tagged go1.23.10-1-openssl-fips.
Refs jsc#SLE-18320
* Rebase to 1.23.10
* Add ubi10, c10s targets to gating
* Thu Jun 05 2025 jkowalczyk@suse.com
- go1.23.10 (released 2025-06-05) includes security fixes to the
net/http and os packages, as well as bug fixes to the linker.
Refs boo#1229122 go1.23 release tracking
CVE-2025-0913 CVE-2025-4673
* go#73719 go#73612 boo#1244157 security: fix CVE-2025-0913 os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows
* go#73905 go#73816 boo#1244156 security: fix CVE-2025-4673 net/http: sensitive headers not cleared on cross-origin redirect
* go#73677 runtime/debug: BuildSetting does not document DefaultGODEBUG
* go#73831 cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen
* Tue May 13 2025 jkowalczyk@suse.com
- Update to version 1.23.9 cut from the go1.23-fips-release
branch at the revision tagged go1.23.9-1-openssl-fips.
Refs jsc#SLE-18320
* No changes to sources, sync with upstream git tag. SUSE local
tag go1.23.9-0 and upstream go1.23.9-1-openssl-fips point to
the same commit.
* Fri May 09 2025 jkowalczyk@suse.com
- Update to version 1.23.9 cut from the go1.23-fips-release
branch at the revision tagged go1.23.9-0-openssl-fips.
Refs jsc#SLE-18320
* Rebase to 1.23.9