diff options
| author | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 19:35:46 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 19:35:46 +0200 |
| commit | 5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086 (patch) | |
| tree | ff3de84061e15d7360e0fe839954e1b4257d28c1 /docs | |
| parent | e94e107071223b2504963dfa95ccd1f2293da752 (diff) | |
| download | krino-5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086.tar.gz krino-5b22b8e3a7d1ae9a3fcc4e894ae2e9d142bf8086.zip | |
go 1.25, toolchain go1.26.8, x/text v0.41.0: fixes GO-2026-5970 and the reachable stdlib vulnerabilities
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/design.md | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/docs/design.md b/docs/design.md index fb8988c..411eeba 100644 --- a/docs/design.md +++ b/docs/design.md @@ -735,7 +735,11 @@ Rules for the GUI to come: ## 14. Build, dependencies, release -- Go 1.24 or newer. `CGO_ENABLED=0`: static binaries on Linux and FreeBSD; +- Go 1.25 or newer (`golang.org/x/text` v0.39 fixed an infinite loop on + invalid input, GO-2026-5970, and needs it). `go.mod` pins the toolchain, + `go1.26.8`, so builds carry the standard library's security fixes: an + older `go` with `GOTOOLCHAIN=auto`, the default, downloads it itself. + `CGO_ENABLED=0`: static binaries on Linux and FreeBSD; on OpenBSD Go links against the system libc, as that platform requires. - Go dependencies: `golang.org/x/term` (key-at-a-time input) and `golang.org/x/text` (Unicode normalisation for `fold`). Everything else is |