diff options
| author | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 19:35:46 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 19:35:46 +0200 |
| commit | 5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086 (patch) | |
| tree | ff3de84061e15d7360e0fe839954e1b4257d28c1 /CHANGELOG.md | |
| parent | e94e107071223b2504963dfa95ccd1f2293da752 (diff) | |
| download | krino-5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086.tar.gz krino-5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086.zip | |
go 1.25, toolchain go1.26.8, x/text v0.41.0: fixes GO-2026-5970 and the reachable stdlib vulnerabilities
Diffstat (limited to 'CHANGELOG.md')
| -rw-r--r-- | CHANGELOG.md | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 2d6db8b..74ff1e3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ ## Unreleased +- Builds need Go 1.25 or newer and use the Go 1.26.8 toolchain, which an + older `go` downloads itself. `golang.org/x/text` is updated to v0.41.0. + This fixes an infinite loop a crafted file's text could cause + (GO-2026-5970) and, through the toolchain, the XML nesting guard + (GO-2026-6088) and the `os/exec` and `os` fixes govulncheck reported. + ## 0.0.6 — 2026-09-14 - Choosing per file: `w` now applies what was decided and quits krino, |