diff options
| author | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 19:35:46 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 19:35:46 +0200 |
| commit | 5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086 (patch) | |
| tree | ff3de84061e15d7360e0fe839954e1b4257d28c1 | |
| parent | e94e107071223b2504963dfa95ccd1f2293da752 (diff) | |
| download | krino-5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086.tar.gz krino-5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086.zip | |
go 1.25, toolchain go1.26.8, x/text v0.41.0: fixes GO-2026-5970 and the reachable stdlib vulnerabilities
| -rw-r--r-- | CHANGELOG.md | 6 | ||||
| -rw-r--r-- | Makefile | 6 | ||||
| -rw-r--r-- | docs/design.md | 6 | ||||
| -rw-r--r-- | go.mod | 6 | ||||
| -rw-r--r-- | go.sum | 4 |
5 files changed, 20 insertions, 8 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 2d6db8b..74ff1e3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ ## Unreleased +- Builds need Go 1.25 or newer and use the Go 1.26.8 toolchain, which an + older `go` downloads itself. `golang.org/x/text` is updated to v0.41.0. + This fixes an infinite loop a crafted file's text could cause + (GO-2026-5970) and, through the toolchain, the XML nesting guard + (GO-2026-6088) and the `os/exec` and `os` fixes govulncheck reported. + ## 0.0.6 — 2026-09-14 - Choosing per file: `w` now applies what was decided and quits krino, @@ -94,10 +94,10 @@ fuzz: ## run every fuzz target for FUZZTIME each (default 20s); a crasher is sav race: ## run the tests under the race detector (needs cgo and a C compiler) CGO_ENABLED=1 go test -race ./... -# govulncheck v1.1.4 is the newest release that builds with Go 1.24 -# (v1.2.0 and later need Go 1.25); GOTOOLCHAIN=local stops a toolchain download. +# govulncheck is pinned; it runs on the toolchain go.mod names, so the +# standard library it checks is the one release builds use. vulncheck: ## check the standard library and dependencies against the Go vulnerability database (network) - GOTOOLCHAIN=local go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./... + go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./... cross: ## cross-compile linux/amd64, linux/arm64, freebsd/amd64, openbsd/amd64 into dist/krino-$(VERSION)-<os>-<arch>/ @case '$(VERSION)' in \ diff --git a/docs/design.md b/docs/design.md index fb8988c..411eeba 100644 --- a/docs/design.md +++ b/docs/design.md @@ -735,7 +735,11 @@ Rules for the GUI to come: ## 14. Build, dependencies, release -- Go 1.24 or newer. `CGO_ENABLED=0`: static binaries on Linux and FreeBSD; +- Go 1.25 or newer (`golang.org/x/text` v0.39 fixed an infinite loop on + invalid input, GO-2026-5970, and needs it). `go.mod` pins the toolchain, + `go1.26.8`, so builds carry the standard library's security fixes: an + older `go` with `GOTOOLCHAIN=auto`, the default, downloads it itself. + `CGO_ENABLED=0`: static binaries on Linux and FreeBSD; on OpenBSD Go links against the system libc, as that platform requires. - Go dependencies: `golang.org/x/term` (key-at-a-time input) and `golang.org/x/text` (Unicode normalisation for `fold`). Everything else is @@ -1,10 +1,12 @@ module krino -go 1.24.0 +go 1.25.0 + +toolchain go1.26.8 require ( golang.org/x/term v0.38.0 - golang.org/x/text v0.34.0 + golang.org/x/text v0.41.0 ) require golang.org/x/sys v0.39.0 // indirect @@ -2,5 +2,5 @@ golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q= golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg= -golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= -golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= |