guix_mirror_bot pushed a commit to branch go-team
in repository guix.
commit 4a398db65762211316c54289cf090173777e9343
Author: Sharlatan Hellseher <[email protected]>
AuthorDate: Mon Aug 17 13:43:51 2026 +0100
gnu: go-1.25: Update to 1.25.13 [security-fixes].
go1.25.13 (released 2026-08-13) includes security fixes to the go
command, and the crypto/tls, encoding/asn1, encoding/xml, html/template,
net/http, and net/url packages, as well as bug fixes to the compiler,
the runtime, and the crypto/tls and os packages.
See: <https://github.com/golang/go/milestone/442>,
<https://groups.google.com/g/golang-announce/c/94pEornpRlI>
Contains fixes for:
CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification
bypass
CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in
Lookup
CVE-2026-56859: encoding/xml: add recursion depth guard during decode
CVE-2026-56853: net/http: apply ReadHeaderTimeout when doing unencrypted
HTTP/2 check
CVE-2026-56860: net/url: avoid quadratic complexity in resolvePath
CVE-2026-46600: golang.org/x/net/dns/dnsmessage: panic when parsing
invalid SVCB record
CVE-2026-56862: crypto/tls: limit handshake messages we are willing to
accept post-handshake
CVE-2026-56858: html/template: fix Javascript regexp context tracking
CVE-2026-39821: x/net/idna: failure to reject ASCII-only
Punycode-encoded labels
CVE-2026-33818: encoding/asn1: enforce maximum recursion depth
* gnu/packages/golang.scm (go-1.25): Update to 1.25.13.
---
gnu/packages/golang.scm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index ef40cfa58d4..db4304aced9 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -1087,7 +1087,7 @@ in the style of communicating sequential processes
(@dfn{CSP}).")
(package
(inherit go-1.24)
(name "go")
- (version "1.25.12")
+ (version "1.25.13")
(source
(origin
(method git-fetch)
@@ -1096,7 +1096,7 @@ in the style of communicating sequential processes
(@dfn{CSP}).")
(commit (string-append "go" version))))
(file-name (git-file-name name version))
(sha256
- (base32 "13191v8vixwf9a1yrn7hz828xfgdgm5dxx4vp0h4s0bzl4rzjn32"))))
+ (base32 "19irn0l27qyjxjim3b5m3ggca786sdz30aw913l4hmwxb26jsb1a"))))
(arguments
(substitute-keyword-arguments (package-arguments go-1.24)
((#:phases phases)
