From 7be7ae44c4d0793138d14550db4fc2d222147b46 Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Wed, 21 Oct 2026 09:59:54 +0530 Subject: [PATCH 1/2] dev-lang/go: Sync with Gentoo It's from Gentoo commit 6b327f4117fb1352bffe4500709860a469ad2b5e. Signed-off-by: Sayan Chowdhury --- .../portage-stable/dev-lang/go/Manifest | 9 +- .../dev-lang/go/go-1.24.12-r1.ebuild | 133 ------------------ .../dev-lang/go/go-1.25.13.ebuild | 2 +- .../dev-lang/go/go-1.25.14.ebuild | 2 +- .../{go-1.26.4.ebuild => go-1.26.10.ebuild} | 2 +- .../dev-lang/go/go-1.26.7.ebuild | 2 +- .../go/{go-1.26.6.ebuild => go-1.26.9.ebuild} | 0 .../dev-lang/go/go-1.27.1.ebuild | 2 +- .../go/{go-1.26.5.ebuild => go-1.27.2.ebuild} | 2 +- .../{go-1.25.12.ebuild => go-1.27.3.ebuild} | 7 +- 10 files changed, 13 insertions(+), 148 deletions(-) delete mode 100644 sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.12-r1.ebuild rename sdk_container/src/third_party/portage-stable/dev-lang/go/{go-1.26.4.ebuild => go-1.26.10.ebuild} (97%) rename sdk_container/src/third_party/portage-stable/dev-lang/go/{go-1.26.6.ebuild => go-1.26.9.ebuild} (100%) rename sdk_container/src/third_party/portage-stable/dev-lang/go/{go-1.26.5.ebuild => go-1.27.2.ebuild} (97%) rename sdk_container/src/third_party/portage-stable/dev-lang/go/{go-1.25.12.ebuild => go-1.27.3.ebuild} (95%) diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest index f37c5f2765a..f1157fda4d3 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest @@ -1,9 +1,8 @@ -DIST go1.24.12.src.tar.gz 30803950 BLAKE2B b3f7d2f1392d3337e6645c4fa53e2e53c4258aa9ecf12b38a10305d172f0c2172d98d273dd030c17f82df17fa3cd5ec464986836261ffdb3324e8f97b2f2b437 SHA512 2de51c56f7ca04003b16d0fecc4cb35a3c5a42bd54f4da1f1e49d45b702d7a872057756d389f2283b4f7283fb33f0618465e231a6333b7cb6cfff98f67b2454e -DIST go1.25.12.src.tar.gz 32013699 BLAKE2B 772ef11f0f0d828980e47fb109bafe2098eb05bfa95bdac9d5c9fcb5f17d114e2f58f824bacf99336cb5316e095e81df2253897f774112cfac2159b2c391c70d SHA512 748341d737c3ce9eb64a0f072c70be7cf3ceab7d1033da2d88b3aea4cf0de96745cded982b6db4a47de505c14e49babf59926fa61e6a86f2e22e61625daf762a DIST go1.25.13.src.tar.gz 32023100 BLAKE2B 37094c66ff5d399a1d2a4b55ea9f3366219ef22b9e26b556d2d7f0cc2f7d0e413636f23b205ddb332ad3e9c9c5914a2333ae727fa8bba2d84aede99574bdc452 SHA512 a7ef774fd747359fd7490baf3a6e4f358a78c38fb56d741c5d5712d34b574d3d722e3e42042f5a6ecd4637707e6c5b159705d4de62027db3684f205e240caa71 DIST go1.25.14.src.tar.gz 32023791 BLAKE2B a81ea6111598162d5b87077d23da67bf5ad587bba40bf24cfef0722a5d87177d8fdb824397d21fb31fb0de0aff694590fbca2a1e917fa3e9fab0ea85aca5c810 SHA512 89cf61d27fc5fa179a821feb4fbd0c55bb8340cdab2adcaa95b52ccf4f5d855034f3acff0e2c1c9e9eaed8c833c5139a04144fa92324755abba13502b07184ac -DIST go1.26.4.src.tar.gz 34118246 BLAKE2B 6a9da2e9b876f52f8f35754ff6640eb5b26c17478a4aad52f8ad4f2b28d12dc74ec8665d0b8c4f77aca3e6332c86c05a5159a9e89684e3c3dc25c16da251bd1f SHA512 adacc6a34ad239d98277acd2ac8da867110da0b184dbbafb82e8a06d2b7fd23434f878a8a8cd550172c21bd31ac6391d01a0bd095c9f5c1250be66b459c8de88 -DIST go1.26.5.src.tar.gz 34140216 BLAKE2B 0903273e37d73ef81e5c88f108f345d21f829aef6cfc5af0c63cc41584ce822912b8e90a989b37dad74debc90d70a9eea99621a043af56003fa9622e96bcb49d SHA512 1c1ff7bc002438e77c968155b077c51df87935d1a1a214c8750e748abe3af5cf83769eae5cfe85ca1b12a0e6fa4a0dfe4344b1023f037f206dad328607bba9f7 -DIST go1.26.6.src.tar.gz 34151057 BLAKE2B 1f67f6f99c3c067388a714f1721eb24d52acf94adece1cded75df3b6c1045b0f2826cfb3edc05b5f1e1db8e17cca0289a69c8aeb8abb2cf244954c5983e6116d SHA512 73325ff6e1ed60228a4c409baf2fc592f41c10f77d86207d3e98d8ca764ec43249c453ac70997dd3990ccbd11efa872bbfcdb6623e0a67b7dfd7ab4cf4dfe1e8 +DIST go1.26.10.src.tar.gz 34164741 BLAKE2B fd95db933aac87f0e04e1ac396c3b653fd963245dc5a29681f6cc1cc9eee82166a7e47efc49496a31852716e2ba769d59618212a0451e443d06f78fc47259d5b SHA512 0de2cc2c331ea0ca4b3bb41b33d6bad3131c8063cd5ae7ddd1ea9ab974fa9a472cb504a88b68cb32b609dca4157c61b1b30d3029186c7bc00559a75cc254ec86 DIST go1.26.7.src.tar.gz 34150794 BLAKE2B c6df632587189b6e67aa1624a0e572d9f15f63a004a43a73aca20575fed93fec8c04d3fd2b62b6c83298d66eb21ceaa93a8e0f1335652c13f99d64d5f1d4147c SHA512 708c8f19d43c7f931287ee0c710eb7a0c4a3d7589f546a59fcdb276f2963d8eb1fba1599977613e751d6de95b8386b6bca8e7d2caf9c555a1d51d1ef0d40289b +DIST go1.26.9.src.tar.gz 34162146 BLAKE2B 5022b8d13979fcc78114ece1024998c41e29d83013dbb26c7f27bc0e03853d4dd6ad61834091d04ac6560992b2aa270c84b48660e3a47e7ded5870287f74eb18 SHA512 cb896e85fa0d7d1dc3d486918651dfa697158e93e2e1f1e564101ff01a415f54385421d771b1edff5fdaaf58d1fd0a2191728ed0c8c8bacf459ff8ce46aa50ba DIST go1.27.1.src.tar.gz 35109201 BLAKE2B ba51f0e3f23bc2fddd39eb87a952f5bce1c9dee0b37ae4918b19b1ddb3038a644ddb8fffd6c5e4685600768ae741dcee801761e752dd0184c76cfbff4d31a872 SHA512 21c928507be39cb91ecb2392a3bf00e1581e176c09e2bf6da447931dffa6198301efa39e106b252c498dbada9251dd5ccc017cbca66b9a0a03bf1e446ee4b5c5 +DIST go1.27.2.src.tar.gz 35134614 BLAKE2B f0b2f642979b186f71d2f574d74fc1a9df8e5298fd5e49b6c575fcc9d3b0c2c30230da62a424134e5fa592dd35004b71f8b25ebdee07c504020fc7dbc2df5504 SHA512 c6b7d28bf670cd01ddb0612e18e639719c423c2891da626393b58038b8fa99afd1511a7cfb8bfe8f4934cb7ddb7bd2b82a3d151fbd3be419d52e86157309a359 +DIST go1.27.3.src.tar.gz 35134035 BLAKE2B 0a4b18bf00808524cec6bae0208378169b417b00b882c1f011518029807f1bf8a19047a4ae3667a410be7ffa7df2fcf765a93d266d4f9dd08eb1a10f4c11661f SHA512 dc84444e0e5e5d4f7bc00f4323ac88c2efa0ce2af4a6e3b3e60325a694389c7ec85ff3aaa9d80df9ff07a2c32620ba57b0c787475f44d80c57c0d22b5c63844c diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.12-r1.ebuild deleted file mode 100644 index 9c64792aecd..00000000000 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.24.12-r1.ebuild +++ /dev/null @@ -1,133 +0,0 @@ -# Copyright 1999-2026 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=8 - -export CBUILD=${CBUILD:-${CHOST}} -export CTARGET=${CTARGET:-${CHOST}} - -# See "Bootstrap" in release notes -GO_BOOTSTRAP_MIN=1.22.12 -MY_PV=${PV/_/} - -inherit go-env toolchain-funcs - -case ${PV} in -*9999*) - EGIT_REPO_URI="https://github.com/golang/go.git" - inherit git-r3 - ;; -*) - SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " - S="${WORKDIR}"/go - KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" - ;; -esac - -DESCRIPTION="A concurrent garbage collected and typesafe programming language" -HOMEPAGE="https://go.dev" - -LICENSE="BSD" -SLOT="0/${PV}" -IUSE="cpu_flags_x86_sse2" - -BDEPEND="|| ( - >=dev-lang/go-${GO_BOOTSTRAP_MIN} - >=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )" - -# the *.syso files have writable/executable stacks -QA_EXECSTACK='*.syso' - -# Do not complain about CFLAGS, etc, since Go doesn't use them. -QA_FLAGS_IGNORED='.*' - -# The tools in /usr/lib/go should not cause the multilib-strict check to fail. -QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*" - -# This package triggers "unrecognized elf file(s)" notices on riscv. -# https://bugs.gentoo.org/794046 -QA_PREBUILT="*" -QA_PRESTRIPPED="*.syso" - -# The Go data race detector (go test -race) requires an unstripped Go toolchain. -# https://bugs.gentoo.org/961618 -RESTRICT="strip" - -DOCS=( - CONTRIBUTING.md - PATENTS - README.md - SECURITY.md -) - -go_tuple() { - echo "$(go-env_goos $@)_$(go-env_goarch $@)" -} - -go_cross_compile() { - [[ $(go_tuple ${CBUILD}) != $(go_tuple) ]] -} - -PATCHES=( - "${FILESDIR}"/go-1.24-skip-gdb-tests.patch - "${FILESDIR}"/go-1.24-dont-force-gold-arm.patch - "${FILESDIR}"/go-never-download-newer-toolchains.patch -) - -src_compile() { - if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then - export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go" - elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then - export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap" - else - eerror "Go cannot be built without go or go-bootstrap installed" - die "Should not be here, please report a bug" - fi - - # Go's build script does not use BUILD/HOST/TARGET consistently. :( - export GOHOSTARCH=$(go-env_goarch ${CBUILD}) - export GOHOSTOS=$(go-env_goos ${CBUILD}) - export CC=$(tc-getBUILD_CC) - - export GOARCH=$(go-env_goarch) - export GOOS=$(go-env_goos) - export CC_FOR_TARGET=$(tc-getCC) - export CXX_FOR_TARGET=$(tc-getCXX) - use arm && export GOARM=$(go-env_goarm) - use x86 && export GO386=$(go-env_go386) - - cd src - bash -x ./make.bash || die "build failed" -} - -src_test() { - go_cross_compile && return 0 - cd src - PATH="${GOBIN}:${PATH}" \ - ./run.bash -no-rebuild -k || die "tests failed" -} - -src_install() { - dodir /usr/lib/go - # The use of cp is deliberate in order to retain permissions - cp -R . "${ED}"/usr/lib/go - einstalldocs - - # testdata directories are not needed on the installed system - # The other files we remove are installed by einstalldocs - rm -r $(find "${ED}"/usr/lib/go -iname testdata -type d -print) || die - rm "${ED}"/usr/lib/go/{CONTRIBUTING.md,PATENTS,README.md} || die - rm "${ED}"/usr/lib/go/{SECURITY.md,codereview.cfg,LICENSE} || die - - local bin_path - if go_cross_compile; then - bin_path="bin/$(go_tuple)" - else - bin_path=bin - fi - local f x - for x in ${bin_path}/*; do - f=${x##*/} - dosym ../lib/go/${bin_path}/${f} /usr/bin/${f} - done -} diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.13.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.13.ebuild index e2709fdfac4..a4da32d3784 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.13.ebuild +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.13.ebuild @@ -20,7 +20,7 @@ case ${PV} in *) SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " S="${WORKDIR}"/go - KEYWORDS="-* amd64 arm arm64 ~loong ~mips ~ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" + KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" ;; esac diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.14.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.14.ebuild index 4fae67fcf5a..11b1353dddb 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.14.ebuild +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.14.ebuild @@ -20,7 +20,7 @@ case ${PV} in *) SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " S="${WORKDIR}"/go - KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~x64-macos ~x64-solaris" + KEYWORDS="-* amd64 ~arm arm64 ~loong ~mips ~ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" ;; esac diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.10.ebuild similarity index 97% rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.4.ebuild rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.10.ebuild index bde6f7b0403..aaf028a4c97 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.4.ebuild +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.10.ebuild @@ -20,7 +20,7 @@ case ${PV} in *) SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " S="${WORKDIR}"/go - KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" + KEYWORDS="-* amd64 ~arm arm64 ~loong ~mips ~ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" ;; esac diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.7.ebuild index 452231977fd..bde6f7b0403 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.7.ebuild +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.7.ebuild @@ -20,7 +20,7 @@ case ${PV} in *) SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " S="${WORKDIR}"/go - KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~x64-macos ~x64-solaris" + KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" ;; esac diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.9.ebuild similarity index 100% rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.6.ebuild rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.9.ebuild diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.1.ebuild index 452231977fd..bde6f7b0403 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.1.ebuild +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.1.ebuild @@ -20,7 +20,7 @@ case ${PV} in *) SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " S="${WORKDIR}"/go - KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~x64-macos ~x64-solaris" + KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" ;; esac diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.2.ebuild similarity index 97% rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.5.ebuild rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.2.ebuild index bde6f7b0403..452231977fd 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.26.5.ebuild +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.2.ebuild @@ -20,7 +20,7 @@ case ${PV} in *) SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " S="${WORKDIR}"/go - KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" + KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~x64-macos ~x64-solaris" ;; esac diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.3.ebuild similarity index 95% rename from sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.12.ebuild rename to sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.3.ebuild index a4da32d3784..452231977fd 100644 --- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.25.12.ebuild +++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.27.3.ebuild @@ -1,13 +1,13 @@ # Copyright 1999-2026 Gentoo Authors # Distributed under the terms of the GNU General Public License v2 -EAPI=8 +EAPI=9 export CBUILD=${CBUILD:-${CHOST}} export CTARGET=${CTARGET:-${CHOST}} # See "Bootstrap" in release notes -GO_BOOTSTRAP_MIN=1.22.12 +GO_BOOTSTRAP_MIN=1.24.6 MY_PV=${PV/_/} inherit flag-o-matic go-env toolchain-funcs @@ -20,7 +20,7 @@ case ${PV} in *) SRC_URI="https://go.dev/dl/go${MY_PV}.src.tar.gz " S="${WORKDIR}"/go - KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~x64-macos ~x64-solaris" + KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~x64-macos ~x64-solaris" ;; esac @@ -71,7 +71,6 @@ go_cross_compile() { PATCHES=( "${FILESDIR}"/go-1.24-skip-gdb-tests.patch "${FILESDIR}"/go-1.25-no-dwarf5.patch - "${FILESDIR}"/go-1.25-strip-top-level-const.patch "${FILESDIR}"/go-never-download-newer-toolchains.patch ) From 7c43338f938fcb2a4695ab3dd6874042def844fc Mon Sep 17 00:00:00 2001 From: Sayan Chowdhury Date: Wed, 21 Oct 2026 10:47:09 +0530 Subject: [PATCH 2/2] dev-lang/go: Bump to 1.26.10 Signed-off-by: Sayan Chowdhury --- changelog/security/2026-10-21-go-1.26.10.md | 1 + changelog/updates/2026-10-21-go-1.26.10-update.md | 1 + .../profiles/coreos/base/package.accept_keywords | 3 --- .../coreos-overlay/profiles/coreos/base/package.mask | 5 +++++ 4 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 changelog/security/2026-10-21-go-1.26.10.md create mode 100644 changelog/updates/2026-10-21-go-1.26.10-update.md diff --git a/changelog/security/2026-10-21-go-1.26.10.md b/changelog/security/2026-10-21-go-1.26.10.md new file mode 100644 index 00000000000..c6ad23ed54d --- /dev/null +++ b/changelog/security/2026-10-21-go-1.26.10.md @@ -0,0 +1 @@ +- Go ([CVE-2026-111943](https://nvd.nist.gov/vuln/detail/CVE-2026-111943), [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857), [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866), [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659), [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660), [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663), [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667), [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669), [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439), [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440), [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444), [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447), [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448), [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030), [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031), [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032)) diff --git a/changelog/updates/2026-10-21-go-1.26.10-update.md b/changelog/updates/2026-10-21-go-1.26.10-update.md new file mode 100644 index 00000000000..d4c5d64cae9 --- /dev/null +++ b/changelog/updates/2026-10-21-go-1.26.10-update.md @@ -0,0 +1 @@ +- Go ([1.26.10](https://go.dev/doc/devel/release#go1.26.10) (includes [1.26.8](https://go.dev/doc/devel/release#go1.26.8), [1.26.9](https://go.dev/doc/devel/release#go1.26.9))) diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords index 8cfadae9b83..a995b17ab27 100644 --- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords @@ -87,9 +87,6 @@ dev-cpp/azure-security-keyvault-keys # To pick up latest 3.5 version Gentoo has. =dev-db/etcd-3.5* ** -# Needed to address security issues. -=dev-lang/go-1.26.7 - # Keep versions on both arches in sync. =dev-lang/swig-4.3.1 =dev-libs/cowsql-1.15.9 ~arm64 diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask index 3b4ca055bd1..0ca9cb042f4 100644 --- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask +++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask @@ -45,3 +45,8 @@ =sec-policy/selinux-dbus-2.20260616_p1 =sec-policy/selinux-policykit-2.20260616_p1 =sec-policy/selinux-sssd-2.20260616_p1 + +# Go 1.27 is already stable, but the stable 1.27.1 is affected by +# CVE-2026-111943. Stay on the 1.26 series (1.26.10 has the fix) until a +# fixed 1.27.x is stable. +>=dev-lang/go-1.27