Skip to content

Commit 38b3e4c

Browse files
thaJeztahthaJeztah
committed
update to go1.25.8, test go1.26.1
go1.25.8 (released 2026-03-05) includes security fixes to the html/template, net/url, and os packages, as well as bug fixes to the go command, the compiler, and the os package. See the Go 1.25.8 milestone on our issue tracker for details. - 1.25.8 https://github.com/golang/go/issues?q=milestone%3AGo1.25.8+label%3ACherryPickApproved - diff: golang/go@go1.25.7...go1.25.8 - 1.26.1 https://github.com/golang/go/issues?q=milestone%3AGo1.26.1+label%3ACherryPickApproved - diff: golang/go@go1.26.0...go1.26.1 --- We have just released Go versions 1.26.1 and 1.25.8, minor point releases. These releases include 5 security fixes following the security policy: crypto/x509: incorrect enforcement of email constraints - When verifying a certificate chain which contains a certificate containing multiple email address constraints (composed of the full email address) which share common local portions (the portion of the address before the '@' character) but different domain portions (the portion of the address after the '@' character), these constraints will not be properly applied, and only the last constraint will be considered. This can allow certificates in the chain containing email addresses which are either not permitted or excluded by the relevant constraints to be returned by calls to Certificate.Verify. Since the name constraint checks happen after chain building is complete, this only applies to certificate chains which chain to trusted roots (root certificates either in VerifyOptions.Roots or in the system root certificate pool), requiring a trusted CA to issue certificates containing either not permitted or excluded email addresses. This issue only affects Go 1.26. Thanks to Jakub Ciolek for reporting this issue. This is CVE-2026-27137 and Go issue https://go.dev/issue/77952. - crypto/x509: panic in name constraint checking for malformed certificates Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS. Since the name constraint checks happen after chain building is complete, this only applies to certificate chains which chain to trusted roots (root certificates either in VerifyOptions.Roots or in the system root certificate pool), requiring a trusted CA to issue certificates containing malformed DNS names. This issue only affects Go 1.26. Thanks to Jakub Ciolek for reporting this issue. This is CVE-2026-27138 and Go issue https://go.dev/issue/77953. - html/template: URLs in meta content attribute actions are not escaped Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0. This is CVE-2026-27142 and Go issue https://go.dev/issue/77954. - net/url: reject IPv6 literal not at start of host The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid. To prevent this behavior, net/url.Parse now rejects IPv6 literals that do not appear at the start of the host subcomponent of a URL. Thanks to Masaki Hara (https://github.com/qnighy) of Wantedly. This is CVE-2026-25679 and Go issue https://go.dev/issue/77578. - os: FileInfo can escape from a Root On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The contents of the FileInfo were populated using the lstat system call, which takes the path to the file as a parameter. If a component of the full path of the file described by the FileInfo is replaced with a symbolic link, the target of the lstat can be directed to another location on the filesystem. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem. This could be used to probe for the presence or absence of files as well as gleaning metadata like file sizes, but does not permit reading or writing files outside the root. The FileInfo is now populated using fstatat. Thank you to Miloslav Trmač of Red Hat for reporting this issue. This is CVE-2026-27139 and Go issue https://go.dev/issue/77827. Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent 6674e65 commit 38b3e4c

9 files changed

Lines changed: 10 additions & 10 deletions

File tree

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"features": {
1313
"ghcr.io/devcontainers/features/docker-in-docker:2": {},
1414
"ghcr.io/devcontainers/features/go:1": {
15-
"version": "1.25.7"
15+
"version": "1.25.8"
1616
}
1717
},
1818

‎.github/actions/install-go/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: "Reusable action to install Go, so there is one place to bump Go ve
33
inputs:
44
go-version:
55
required: true
6-
default: "1.25.7"
6+
default: "1.25.8"
77
description: "Go version to install"
88

99
runs:

‎.github/workflows/api-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
name: API Release
77

88
env:
9-
GO_VERSION: "1.25.7"
9+
GO_VERSION: "1.25.8"
1010

1111
permissions: # added using https://github.com/step-security/secure-workflows
1212
contents: read

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ jobs:
186186
strategy:
187187
matrix:
188188
os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
189-
go-version: ["1.25.7", "1.26.0"]
189+
go-version: ["1.25.8", "1.26.1"]
190190
exclude:
191191
- os: ${{ github.event.repository.private && 'ubuntu-24.04-arm' || '' }}
192192
steps:

‎.github/workflows/release/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
ARG UBUNTU_VERSION=22.04
1616
ARG BASE_IMAGE=ubuntu:${UBUNTU_VERSION}
17-
ARG GO_VERSION=1.25.7
17+
ARG GO_VERSION=1.25.8
1818
ARG GO_IMAGE=golang:${GO_VERSION}
1919
FROM --platform=$BUILDPLATFORM $GO_IMAGE AS go
2020
FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ EOF
109109
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
110110
sh.upload_path = "/tmp/vagrant-install-golang"
111111
sh.env = {
112-
'GO_VERSION': ENV['GO_VERSION'] || "1.25.7",
112+
'GO_VERSION': ENV['GO_VERSION'] || "1.25.8",
113113
}
114114
sh.inline = <<~SHELL
115115
#!/usr/bin/env bash

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
# docker run --privileged --group-add keep-groups -v ./critest_exit_code.txt:/tmp/critest_exit_code.txt containerd-test
3535
# ------------------------------------------------------------------------------
3636

37-
ARG GOLANG_VERSION=1.25.7
37+
ARG GOLANG_VERSION=1.25.8
3838
ARG GOLANG_IMAGE=golang
3939

4040
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

‎contrib/fuzz/oss_fuzz_build.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ compile_fuzzers() {
3939

4040
apt-get update && apt-get install -y wget
4141
cd $SRC
42-
wget --quiet https://go.dev/dl/go1.25.7.linux-amd64.tar.gz
42+
wget --quiet https://go.dev/dl/go1.25.8.linux-amd64.tar.gz
4343

4444
mkdir temp-go
4545
rm -rf /root/.go/*
46-
tar -C temp-go/ -xzf go1.25.7.linux-amd64.tar.gz
46+
tar -C temp-go/ -xzf go1.25.8.linux-amd64.tar.gz
4747
mv temp-go/go/* /root/.go/
4848
cd $SRC/containerd
4949

‎script/setup/prepare_env_windows.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# lived test environment.
66
Set-MpPreference -DisableRealtimeMonitoring:$true
77

8-
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.25.7"; make = ""; nssm = "" }
8+
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.25.8"; make = ""; nssm = "" }
99

1010
Write-Host "Downloading chocolatey package"
1111
curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

0 commit comments

Comments
 (0)