golang-1.26 (1.26.0-1) unstable; urgency=medium

  * New upstream version 1.26.0
    - Refresh patch

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 11 Feb 2026 16:43:25 +0100

golang-1.26 (1.26~rc3-2) unstable; urgency=medium

  * Skip TestTSAN test on s390x.
    The test consistently fails, and is probably a real bug.
    It's currently being investigated, but until that is
    resolved, we disable the test to be able to build the
    golang package, so it can migrate to testing.
    See https://github.com/golang/go/issues/77289
    and Debian BTS #1126312
  * Update d/copyright
    - Use Comment: as field name in d/copyright
    - Remove src/image/jpeg/idct.go from d/copyright, has been
      removed upstream
    - Remove MPEG license terms, no longer needed
    - Update d/copyright with correct license name.
    - Use Go license for d/rules, just like all other files
      in that directory
    - Update license name from FreeBSD to BSD-2-Clause
    - Add d/lrc.config as license hints for lrc
  * Run wrap-and-sort -astkb
  * Remove Breaks: dh-golang (<< 1.43~), o-o-stable is at 1.51
  * Remove leading '/' from .install files
  * Remove unused lintian overrides
  * Add lintian overrides for golang-X.Y-src
  * Add myself as uploader, somehow I got involved again. :-)

 -- Dr. Tobias Quathamer <toddy@debian.org>  Tue, 10 Feb 2026 00:00:48 +0100

golang-1.26 (1.26~rc3-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.26~rc3
  * Remove Priority: optional from d/control
  * Remove Rules-Requires-Root from d/control
  * Update Standards-Version to 4.7.3

 -- Dr. Tobias Quathamer <toddy@debian.org>  Mon, 09 Feb 2026 10:15:40 +0100

golang-1.26 (1.26~rc2-1) unstable; urgency=medium

  * Initial upload of Go 1.26 (rc2)

 -- Tianon Gravi <tianon@debian.org>  Sat, 24 Jan 2026 00:13:51 -0800

golang-1.25 (1.25.6-1) unstable; urgency=medium

  [ Anshul Singh ]
  * Update to 1.25.5 upstream release
    https://go.dev/doc/devel/release#go1.25.5
    - crypto/x509: excessive resource consumption in printing error string for host certificate validation
    - crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

  [ Tianon Gravi ]
  * Update to 1.25.6 upstream release

    1.25.6: (Closes: #1125916)
    - https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc/m/pQP7Bk0aCQAJ

    - CVE-2025-61728: https://go.dev/issue/77102
      archive/zip: denial of service when parsing arbitrary ZIP archives

    - CVE-2025-61726: https://go.dev/issue/77101
      net/http: memory exhaustion in Request.ParseForm

    - CVE-2025-68121: https://go.dev/issue/77113
      crypto/tls: Config.Clone copies automatically generated session ticket
      keys, session resumption does not account for the expiration of full
      certificate chain

    - CVE-2025-61731: https://go.dev/issue/77100
      cmd/go: bypass of flag sanitization can lead to arbitrary code
      execution

    - CVE-2025-68119: https://go.dev/issue/77099
      cmd/go: unexpected code execution when invoking toolchain

    - CVE-2025-61730: https://go.dev/issue/76443
      crypto/tls: handshake messages may be processed at the incorrect
      encryption level

    - os: allow direntries to have zero inodes on Linux (Closes: #1115301)

    1.25.5: (Closes: #1121847)
    - https://groups.google.com/g/golang-announce/c/8FJoBkPddm4/m/kYpVlPw1CQAJ

    - CVE-2025-61729: https://go.dev/issue/76445
      crypto/x509: excessive resource consumption in printing error string for
      host certificate validation

    - CVE-2025-61727: https://go.dev/issue/76442
      crypto/x509: excluded subdomain constraint does not restrict wildcard
      SANs

    1.25.4:
    - https://groups.google.com/g/golang-announce/c/tVVHm9gnwl8/m/-oTvYIjCAQAJ

  * Fix build with DEB_BUILD_OPTIONS=terse (Closes: #1125464)
    (solution borrowed from xz-utils debian/rules)

 -- Tianon Gravi <tianon@debian.org>  Thu, 22 Jan 2026 23:07:54 -0800

golang-1.25 (1.25.3-1) unstable; urgency=medium

  * Update to 1.25.3 upstream release
    https://go.dev/doc/devel/release#go1.25.3
    - fixes to the crypto/x509 package (https://go.dev/issue/75828)

 -- Tianon Gravi <tianon@debian.org>  Mon, 13 Oct 2025 16:06:52 -0700

golang-1.25 (1.25.2-1) unstable; urgency=medium

  * Add Go 1.25 to acceptable bootstrap versions (Build-Depends)
  * Update upstream signing key
  * Update to 1.25.2 upstream release
    https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI/m/qZN5nc-mBgAJ
    - CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress
    - CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints
    - CVE-2025-58189: crypto/tls: ALPN negotiation errors can contain arbitrary text
    - CVE-2025-61723: encoding/pem: quadratic complexity when parsing some invalid inputs
    - CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames
    - CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion
    - CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion
    - CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys
    - CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map
    - CVE-2025-61724: net/textproto: excessive CPU consumption in Reader.ReadResponse

 -- Tianon Gravi <tianon@debian.org>  Thu, 09 Oct 2025 20:14:29 -0700

golang-1.25 (1.25.1-1) unstable; urgency=medium

  * Update to 1.25.1 upstream release
    - net/http: CrossOriginProtection bypass patterns are over-broad
      (CVE-2025-47910; https://go.dev/issue/75054; Closes: #1116341)

 -- Tianon Gravi <tianon@debian.org>  Sat, 27 Sep 2025 21:09:25 -0700

golang-1.25 (1.25.0-2) unstable; urgency=medium

  [ Tianon Gravi ]
  * Add support for cross-building natively (Closes: #1100436)
    - https://salsa.debian.org/go-team/compiler/golang/-/merge_requests/21
  * Clean up debian/helpers/goenv.sh (notably no more go1.16 support)

  [ Bo YU ]
  * Skip failing TSAN tests on riscv64 (Closes: #1115478)

 -- Tianon Gravi <tianon@debian.org>  Fri, 19 Sep 2025 21:11:23 -0700

golang-1.25 (1.25.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.25.0.

 -- Anshul Singh <anshul.singh@canonical.com>  Fri, 08 Aug 2025 05:13:23 +0000

golang-1.24 (1.24.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.1
    + CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (Closes: #1107364)
    + CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows
    + CVE 2025-22874: crypto/x509: usage of ExtKeyUsageAny disables policy validation (Closes: #1107364)
    + CVE-2025-22873: os: Root permits access to parent directory (Closes: #1104816)
  * d/patches: Removed patch 0003 as it's already applied upstream now

 -- Anshul Singh <anshul.singh@canonical.com>  Mon, 16 Jun 2025 17:04:18 +0530

golang-1.24 (1.24.2-2) unstable; urgency=medium

  * Team upload
  * Backport patch to fix SIGSEGV in vgetrandom on Linux 6.11+
    (Closes: #1103345)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 17 Apr 2025 22:45:41 +0800

golang-1.24 (1.24.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.2
    + CVE-2025-22871: net/http: request smuggling through invalid chunked data

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 03 Apr 2025 14:56:38 +0800

golang-1.24 (1.24.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.1
    + CVE-2025-22870: net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass
      using IPv6 zone IDs
  * Install lib directory to golang-X.Y-src package.
    This includes lib/wasm directory which is moved from misc/wasm
    in Go 1.24. (Closes: #1096251)

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 05 Mar 2025 07:58:41 +0800

golang-1.24 (1.24.0-2) unstable; urgency=medium

  * Team upload
  * Add golang-1.24-go to Build-Depends

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 25 Feb 2025 18:09:52 +0800

golang-1.24 (1.24.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 12 Feb 2025 03:00:57 +0800

golang-1.24 (1.24~rc3-2) unstable; urgency=medium

  * Team upload
  * Add binutils-gold to Build-Depends on arm64 (Closes: #1095697)
  * And binutils-gold to Depends for golang-X.Y-go on arm64

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 12 Feb 2025 02:18:15 +0800

golang-1.24 (1.24~rc3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24~rc3
    + CVE-2025-22866: crypto/elliptic: timing sidechannel for P-256 on ppc64le
    + CVE-2025-22867: cmd/go: arbitrary code execution during build on darwin

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 07 Feb 2025 21:01:51 +0800

golang-1.24 (1.24~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24~rc2
  * Revert "Backport patch to fix tests using expired certificates"

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 21 Jan 2025 14:14:07 +0800

golang-1.24 (1.24~rc1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24~rc1
  * Bump minimal bootstrap Go version to 1.22
  * Backport patch to fix tests using expired certificates

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 07 Jan 2025 14:33:53 +0800

golang-1.23 (1.23.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.4

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 04 Dec 2024 08:34:52 +0800

golang-1.23 (1.23.3-2) unstable; urgency=medium

  * Team upload
  * Running regression autopkgtest with root

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 12 Nov 2024 17:15:48 +0800

golang-1.23 (1.23.3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.3
  * Switch to versioned golang-1.XX-go packages for building.
    Break circular loop with golang-defaults metapackage (Closes: #1081647)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 07 Nov 2024 15:32:48 +0800

golang-1.23 (1.23.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.2

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 03 Oct 2024 14:40:06 +0800

golang-1.23 (1.23.1-3) unstable; urgency=medium

  * Team upload
  * Increase timeout to 2h in autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 12 Sep 2024 13:21:49 +0800

golang-1.23 (1.23.1-2) unstable; urgency=medium

  * Team upload
  * Increase timeout to 1h in autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 11 Sep 2024 14:05:33 +0800

golang-1.23 (1.23.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.1
    + CVE-2024-34155: go/parser: stack exhaustion in all Parse* functions
    + CVE-2024-34156: encoding/gob: stack exhaustion in Decoder.Decode
    + CVE-2024-34158: go/build/constraint: stack exhaustion in Parse

 -- Shengjing Zhu <zhsj@debian.org>  Mon, 09 Sep 2024 16:26:12 +0800

golang-1.23 (1.23.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 14 Aug 2024 07:05:45 +0800

golang-1.23 (1.23~rc2-2) unstable; urgency=medium

  * Team upload
  * Increase test timeout in autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 19 Jul 2024 16:05:05 +0800

golang-1.23 (1.23~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23~rc2

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 17 Jul 2024 16:34:37 +0800

golang-1.23 (1.23~rc1-1) unstable; urgency=medium

  * Team upload.

  [ Dr. Tobias Quathamer ]
  * Remove myself from Uploaders

  [ Shengjing Zhu ]
  * New upstream version 1.23~rc1
  * Replace pkg-config with pkgconf

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 02 Jul 2024 16:20:00 +0800

golang-1.22 (1.22.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.4
    + CVE-2024-24789: archive/zip: mishandling of corrupt central directory
      record
    + CVE-2024-24790: net/netip: unexpected behavior from Is methods for
      IPv4-mapped IPv6 addresses

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 05 Jun 2024 07:31:05 +0800

golang-1.22 (1.22.3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.3
    + CVE-2024-24788: net: malformed DNS message can cause infinite loop

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 08 May 2024 17:11:30 +0800

golang-1.22 (1.22.2-2) unstable; urgency=medium

  * Team upload
  * Skip flaky TestCrashDumpsAllThreads on s390x (LP: #2061742)
    https://github.com/golang/go/issues/64650

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 16 Apr 2024 16:13:31 +0800

golang-1.22 (1.22.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.2
    + CVE-2023-45288: http2: close connections when receiving too many headers
  * Revert "Backport patch to fix external link on riscv64" (applied in 1.22.2)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 04 Apr 2024 04:23:15 +0800

golang-1.22 (1.22.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.1
    + CVE-2024-24783: crypto/x509: Verify panics on certificates with an
      unknown public key algorithm
    + CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm
    + CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of
      sensitive headers and cookies on HTTP redirect
    + CVE-2024-24785: html/template: errors returned from MarshalJSON methods
      may break template escaping
    + CVE-2024-24784: net/mail: comments in display names are incorrectly
      handled
  * Update upstream signing key
  * Backport patch to fix external link on riscv64 (Closes: #1065368)

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 06 Mar 2024 15:09:10 +0800

golang-1.22 (1.22.0-2) unstable; urgency=medium

  * Team upload
  * Skip flaky TestCrashDumpsAllThreads on mips64le

 -- Shengjing Zhu <zhsj@debian.org>  Mon, 26 Feb 2024 17:08:17 +0800

golang-1.22 (1.22.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 21 Feb 2024 16:57:04 +0800

golang-1.22 (1.22~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22~rc2
  * Bump bootstrap Go to 1.20.
    See https://github.com/golang/go/issues/54265
    gccgo only implements Go 1.18 and can't bootstrap Go 1.22 now.
  * Revert "Skip TestUser{Cache,Config}Dir when HOME is not writable"
    This reverts commit 5e8f93837a5d73a391fbbc278a34e5a89f84ca9b.
    Fixed by upstream https://github.com/golang/go/issues/64990

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 30 Jan 2024 17:15:39 +0800

golang-1.22 (1.22~rc1-2) unstable; urgency=medium

  * Skip TestUser{Cache,Config}Dir when HOME is not writable

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 06 Jan 2024 21:26:23 +0800

golang-1.22 (1.22~rc1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22rc1
  * Build loong64 binaries (Closes: #1055087)
  * Avoid downloading a newer toolchain when bootstrap

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 04 Jan 2024 17:22:48 +0800

golang-1.21 (1.21.5-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.5
    + CVE-2023-39326: net/http: limit chunked data overhead
    + CVE-2023-45285: cmd/go: go get may unexpectedly fallback to insecure git
    + CVE-2023-45283: path/filepath: retain trailing \ when cleaning paths
      like \\?\c:\

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 06 Dec 2023 15:32:23 +0800

golang-1.21 (1.21.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.4
    + CVE-2023-45283: path/filepath: recognize \??\ as a Root Local Device
      path prefix.
    + CVE-2023-45284: path/filepath: recognize device names with trailing
      spaces and superscripts.

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 08 Nov 2023 03:40:30 +0800

golang-1.21 (1.21.3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.3
    + CVE-2023-44487/CVE-2023-39325: net/http: rapid stream resets can cause
      excessive work

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 11 Oct 2023 14:53:53 +0800

golang-1.21 (1.21.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.2
    + CVE-2023-39323: cmd/go: line directives allows arbitrary execution during
      build

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 06 Oct 2023 19:35:37 +0800

golang-1.21 (1.21.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.1
    + CVE-2023-39320: cmd/go: go.mod toolchain directive allows arbitrary
      execution
    + CVE-2023-39318: html/template: improper handling of HTML-like comments
      within script contexts
    + CVE-2023-39319: html/template: improper handling of special tags within
      script contexts
    + CVE-2023-39321/CVE-2023-39322: crypto/tls: panic when processing
      post-handshake message on QUIC connections

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 07 Sep 2023 11:51:55 +0800

golang-1.21 (1.21.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 09 Aug 2023 14:40:00 +0800

golang-1.21 (1.21~rc4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21~rc4

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 03 Aug 2023 15:15:53 +0800

golang-1.21 (1.21~rc3-2) unstable; urgency=medium

  * Team upload
  * Add Breaks+Replaces golang-1.21-go (<< 1.21~rc3) on golang-1.21-src
    src/internal/platform/zosarch.go move from golang-1.21-go to
    golang-1.21-src (Closes: #1041412)

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 19 Jul 2023 16:12:19 +0800

golang-1.21 (1.21~rc3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21~rc3

 -- Shengjing Zhu <zhsj@debian.org>  Mon, 17 Jul 2023 15:20:39 +0800

golang-1.21 (1.21~rc2-2) unstable; urgency=medium

  * Team upload
  * Add autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 29 Jun 2023 16:33:35 +0800

golang-1.21 (1.21~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21~rc2

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 22 Jun 2023 14:53:06 +0800

golang-1.21 (1.21~rc1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21rc1
  * Install go.env in GOROOT
  * Drop patches
    + 0001-Disable-test-for-UserHomeDir.patch.
      Now the test doesn't fail if HOME dir doesn't exist
      See https://github.com/golang/go/commit/bb4ea80b
    + 0002-Fix-Lintian-warnings-about-wrong-interpreter-path.patch.
      We don't run these scripts, just leave them as is.
    + 0003-cmd-dist-increase-default-timeout-scale-for-arm.patch.
      Upstream has removed arch-specific timeout scale heuristics.
      See https://github.com/golang/go/issues/57117
      We can move the setting to dh-golang.
    + 0004-skip-userns-test-in-schroot-as-well.patch.
      Now the tests doesn't hardcode chroot types.
      See https://github.com/golang/go/commit/09267142

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 20 Jun 2023 17:39:49 +0800

golang-1.20 (1.20.5-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.20.5
    + CVE-2023-29402: cmd/go: cgo code injection
    + CVE-2023-29403: runtime: unexpected behavior of setuid/setgid binaries
    + CVE-2023-29404/CVE-2023-29405: cmd/go: improper sanitization of LDFLAGS

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 07 Jun 2023 12:05:11 +0800

golang-1.20 (1.20.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.20.4
    + CVE-2023-24539: html/template: improper sanitization of CSS values
    + CVE-2023-24540: html/template: improper handling of JavaScript whitespace
    + CVE-2023-29400: html/template: improper handling of empty HTML attributes

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 03 May 2023 14:56:49 +0800

golang-1.20 (1.20.3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.20.3
    + CVE-2023-24537: go/parser: infinite loop in parsing
    + CVE-2023-24538: html/template: backticks not treated as string delimiters
    + CVE-2023-24534: net/http, net/textproto: denial of service from excessive
      memory allocation
    + CVE-2023-24536: net/http, net/textproto, mime/multipart: denial of
      service from excessive resource consumption

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 05 Apr 2023 02:04:08 +0800

golang-1.20 (1.20.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.20.2
    + CVE-2023-24532: crypto/elliptic: incorrect P-256 ScalarMult and
      ScalarBaseMult results

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 08 Mar 2023 13:57:35 +0800

golang-1.20 (1.20.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.20.1
    + CVE-2022-41722: path/filepath: path traversal in filepath.Clean on
      Windows
    + CVE-2022-41725: net/http, mime/multipart: denial of service from
      excessive resource consumption
    + CVE-2022-41724: crypto/tls: large handshake records may cause panics
    + CVE-2022-41723: net/http: avoid quadratic complexity in HPACK decoding

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 15 Feb 2023 09:53:55 +0800

golang-1.20 (1.20-1) unstable; urgency=medium

  * Team upload
  * New upstream release 1.20
  * Remove patches applied upstream:
    - d/patches/0005-Revert-internal-fsys-follow-root-symlink-in-fsys.Wal.patch
    - d/patches/0006-time-revert-strict-parsing-of-RFC-3339.patch

 -- Michael Hudson-Doyle <mwhudson@debian.org>  Thu, 02 Feb 2023 13:54:15 +1300

golang-1.20 (1.20~rc3-2) unstable; urgency=medium

  * Team upload
  * Revert strict parsing of RFC 3339.
    See https://github.com/golang/go/issues/54580

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 19 Jan 2023 16:45:22 +0800

golang-1.20 (1.20~rc3-1) unstable; urgency=medium

  [ William 'jawn-smith' Wilson ]
  * New upstream version 1.20 rc3

  [ Shengjing Zhu ]
  * Drop 0005-syscall-skip-TestUseCgroupFD-if-cgroupfs-not-mounted.patch,
    merged in new version.

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 13 Jan 2023 09:51:55 +0800

golang-1.20 (1.20~rc2-2) unstable; urgency=medium

  * Team upload
  * Add NO_PNG_PKG_MANGLE to prevent mangling testdata.
    This is Ubuntu specific behaviour so they can sync the package without
    vendor patch.
  * Revert "internal/fsys: follow root symlink in fsys.Walk"
    Fix https://github.com/golang/go/issues/57754

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 12 Jan 2023 22:27:08 +0800

golang-1.20 (1.20~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.20~rc2
  * Bump bootstrap Go to 1.17.
    See https://github.com/golang/go/issues/44505
  * Drop i386 bootstrap workaround with Go < 1.16
  * Add patch to skip TestUseCgroupFD for schroot
  * Update Standards-Version to 4.6.2 (no changes)
  * $GOROOT/pkg no longer stores pre-compiled package archives for the
    standard library
  * Make all scripts in src directory executable. To silence lintian.
  * Refresh lintian overrides

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 05 Jan 2023 16:01:28 +0800

golang-1.19 (1.19.4-1) unstable; urgency=medium

  * New upstream version 1.19.4
    + CVE-2022-41720: os, net/http: avoid escapes from os.DirFS and http.Dir
      on Windows
    + CVE-2022-41717: net/http: limit canonical header cache by bytes, not
      entries

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Tue, 06 Dec 2022 16:10:54 -0600

golang-1.19 (1.19.3-1) unstable; urgency=medium

  * New upstream version 1.19.3
    + CVE-2022-41716: syscall, os/exec: unsanitized NUL in environment variables
      On Windows, syscall.StartProcess and os/exec.Cmd did not properly check
      for invalid environment variable values. A malicious environment variable
      value could exploit this behavior to set a value for a different
      environment variable.

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Thu, 03 Nov 2022 08:39:47 -0500

golang-1.19 (1.19.2-1) unstable; urgency=medium

  * New upstream version 1.19.2
    + CVE-2022-2879: archive/tar: unbounded memory consumption when reading
      headers
    + CVE-2022-2880: net/http/httputil: ReverseProxy should not forward
      unparseable query parameters
    + CVE-2022-41715: regexp/syntax: limit memory used by parsing regexps

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Tue, 04 Oct 2022 15:23:25 -0500

golang-1.19 (1.19.1-1) unstable; urgency=medium

  * New upstream version 1.19.1

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Tue, 06 Sep 2022 14:58:49 -0500

golang-1.19 (1.19-1) unstable; urgency=medium

  * New upstream version 1.19
  * Update d/docs to reflect upstream removal of AUTHORS and CONTRIBUTORS

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Tue, 02 Aug 2022 15:35:20 -0500

golang-1.19 (1.19~rc2-1) unstable; urgency=medium

  * New upstream version 1.19 rc2

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Tue, 12 Jul 2022 18:32:28 -0500

golang-1.19 (1.19~rc1-1) unstable; urgency=medium

  * Team upload.
  * Update upstream signing key.
    Download from https://dl.google.com/dl/linux/linux_signing_key.pub
  * New upstream version 1.19~rc1
    + Fix boostrap with gccgo (Closes: #1014238)
  * Update Standards-Version to 4.6.1 (no changes)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 07 Jul 2022 23:42:03 +0800

golang-1.19 (1.19~beta1-2) unstable; urgency=medium

  * Team upload.
  * Source-only upload for migration to testing

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 02 Jul 2022 03:11:52 +0800

golang-1.19 (1.19~beta1-1) unstable; urgency=medium

  * New upstream version 1.19 beta1

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Fri, 10 Jun 2022 13:52:13 -0500

golang-1.18 (1.18.3-1) unstable; urgency=medium

  * New upstream version 1.18.3

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Wed, 01 Jun 2022 17:23:29 -0500

golang-1.18 (1.18.2-2) unstable; urgency=medium

  * d/p/0007-cmd-link-use-TOC-relative-trampolines-on-PPC64-when-.patch:
    Remove patch.  It's causing the build on ppc64el to FTBFS during link
    time.

 -- Sergio Durigan Junior <sergiodj@debian.org>  Sat, 14 May 2022 15:22:04 -0400

golang-1.18 (1.18.2-1) unstable; urgency=medium

  * New upstream version 1.18.2
  * d/p/0007-cmd-link-use-TOC-relative-trampolines-on-PPC64-when-.patch:
    Use TOC-relative trampolines on ppc64el when needed.  Fix link error
    when building PIE binaries. (Closes: #1010942)

 -- Sergio Durigan Junior <sergiodj@debian.org>  Fri, 13 May 2022 14:07:03 -0400

golang-1.18 (1.18.1-1) unstable; urgency=medium

  * New upstream version 1.18.1
    + CVE-2022-24675: encoding/pem: fix stack overflow in Decode
    + CVE-2022-28327: crypto/elliptic: tolerate all oversized scalars
      in generic P-256
    + CVE-2022-27536: crypto/x509: non-compliant certificates can
      cause a panic in Verify on macOS in Go 1.18

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Wed, 13 Apr 2022 12:54:36 -0500

golang-1.18 (1.18-1) unstable; urgency=medium

  * New upstream version 1.18

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Tue, 15 Mar 2022 14:59:19 -0500

golang-1.18 (1.18~rc1-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.18~rc1

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 18 Feb 2022 01:31:48 +0800

golang-1.18 (1.18~beta2-1) unstable; urgency=medium

  * New upstream version 1.18 beta2

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Mon, 31 Jan 2022 16:53:48 -0600

golang-1.18 (1.18~beta1-2) unstable; urgency=medium

  * Source-only upload for migration to testing

 -- Anthony Fok <foka@debian.org>  Thu, 13 Jan 2022 14:01:05 -0700

golang-1.18 (1.18~beta1-1) unstable; urgency=medium

  * New upstream version 1.18 beta1

 -- William 'jawn-smith' Wilson <jawn-smith@ubuntu.com>  Wed, 15 Dec 2021 16:07:48 -0600

golang-1.17 (1.17.5-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.17.5
    + CVE-2021-44716: net/http: limit growth of header canonicalization cache
    + CVE-2021-44717: syscall: don’t close fd 0 on ForkExec error

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 09 Dec 2021 23:22:36 +0800

golang-1.17 (1.17.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.17.4

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 04 Dec 2021 01:32:29 +0800

golang-1.17 (1.17.3-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.17.3
    + CVE-2021-41771: debug/macho: invalid dynamic symbol table command
      can cause panic
    + CVE-2021-41772: archive/zip: Reader.Open panics on empty string

 -- Shengjing Zhu <zhsj@debian.org>  Sun, 07 Nov 2021 22:33:32 +0800

golang-1.17 (1.17.2-1) unstable; urgency=medium

  * Team upload.

  [ Anthony Fok ]
  * Fix Lintian warning: tab-in-license-text
    debian/copyright (starting at line 366)

  [ Shengjing Zhu ]
  * Ensure GOROOT_BOOTSTRAP is valid
  * Set GOPATH in d/rules.
    Seems the go command needs GOPATH env
  * New upstream version 1.17.2
    + CVE-2021-38297: When invoking functions from WASM modules, built using
      GOARCH=wasm GOOS=js, passing very large arguments can cause portions of
      the module to be overwritten with data from the arguments

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 09 Oct 2021 01:23:05 +0800

golang-1.17 (1.17.1-1) unstable; urgency=high

  * New upstream version 1.17.1
    + CVE-2021-39293: security fix to the archive/zip package
      The fix for CVE-2021-33196 can be bypassed by crafted inputs.
      As a result, the NewReader and OpenReader functions in archive/zip
      can still cause a panic or an unrecoverable fatal error when reading
      an archive that claims to contain a large number of files,
      regardless of its actual size.
      Thanks to the OSS-Fuzz project for discovering this issue
      and to Emmanuel Odeke for reporting it.
    + bug fixes to the archive/zip, go/internal/gccgoimporter,
      html/template, net/http, and runtime/pprof packages
  * Re-add "Multi-Arch: foreign" hint
  * Rename Maintainer from "Go Compiler Team" to "Debian Go Compiler Team"
  * Bump Standards-Version to 4.6.0 (no change)

 -- Anthony Fok <foka@debian.org>  Fri, 10 Sep 2021 18:01:21 -0600

golang-1.17 (1.17-3) unstable; urgency=medium

  * Team upload.
  * Add missing generated buildcfg file (Closes: #993450)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 02 Sep 2021 00:08:21 +0800

golang-1.17 (1.17-2) unstable; urgency=medium

  * Team upload.
  * Fix extracting go version for gccgo

 -- Shengjing Zhu <zhsj@debian.org>  Sun, 29 Aug 2021 01:16:12 +0800

golang-1.17 (1.17-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.17
  * Refresh patches, dropping
    0003-cmd-go-cmd-cgo-pass-mfp32-and-mhard-soft-float-to-MI.patch which was
    merged upstream.
  * Do not include the now-deleted favicon.ico in golang-1.17-doc.
  * Add one more arch-independent-package-contains-binary-or-object lintian
    suppression.

 -- Michael Hudson-Doyle <mwhudson@debian.org>  Tue, 17 Aug 2021 13:03:28 +1200

golang-1.16 (1.16.7-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.16.7
    + CVE-2021-36221: net/http: panic due to racy read of persistConn after
      handler panic

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 06 Aug 2021 02:38:44 +0800

golang-1.16 (1.16.6-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.16.6
    + CVE-2021-34558: crypto/tls: clients can panic when provided a certificate
      of the wrong type for the negotiated parameters

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 13 Jul 2021 13:11:46 +0800

golang-1.16 (1.16.5-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.16.5
    + CVE-2021-33195: net: Lookup functions may return invalid host names
    + CVE-2021-33196: archive/zip: malformed archive may cause panic or memory
      exhaustion (Closes: #989492)
    + CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection
      headers if first one is empty
    + CVE-2021-33198: math/big: (*Rat).SetString with "1.770p02041010010011001001"
      crashes with "makeslice: len out of range"

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 05 Jun 2021 19:03:59 +0800

golang-1.16 (1.16.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.16.4
    Fix CVE-2021-31525 net/http: ReadRequest can stack overflow due to
    recursion with very large headers

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 08 May 2021 02:27:38 +0800

golang-1.16 (1.16.3-4) unstable; urgency=medium

  * Team upload.
  * Remove bootstrap dir after build. Otherwise tests fail

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 20 Apr 2021 02:05:56 +0800

golang-1.16 (1.16.3-3) unstable; urgency=medium

  * Team upload.
  * Drop mtime hack in postinst and d/rules
    https://github.com/golang/go/issues/3506#issuecomment-341310161
    > Essentially everything involved in this report has been rewritten.
    > The go command no longer cares about mtimes.
  * No need to remove src dir in golang-$(GOVER)-go package.
    It's not installed by golang-X.Y-go.dirs now
  * Update description and recommended way to use specified version (Closes: #985542)
  * Rebuild with go1.16.
    To build with GO386=softfloat, https://github.com/golang/go/issues/44500
  * Add Multi-Arch hint
  * Only build in -arch target again.
    Move generated source files to golang-1.16-go package
  * Not force gencontrol in dh_clean.
    Not needed after the new branch is created. And we need to add some
    Breaks/Replaces to d/control which should not be in next version
  * Remove GOCACHE before dh_install.
    So it is executed when build with nocheck as well

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 20 Apr 2021 00:46:07 +0800

golang-1.16 (1.16.3-2) unstable; urgency=medium

  * Team upload.
  * Also build package in indep target (Closes: #987126)
    As the -src package moved to arch all,
  * Build with empty GO386 env on i386 for now.
    It's no possible to build go1.16 with go1.15 with either
    GO386=softfloat or GO386=387.
    We can rebuild go1.16 with go1.16 and GO386=softfloat later.

 -- Shengjing Zhu <zhsj@debian.org>  Sun, 18 Apr 2021 17:27:43 +0800

golang-1.16 (1.16.3-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.16.3
    Fix CVE-2021-27918 CVE-2021-27919
  * Move golang-X.Y-src to arch all.
    The package doesn't contain arch specific source now.
  * Update golang-X.Y-doc package description.
    Most contents are removed by upstream in 1.16, which is moved to
    x/website repository. And the godoc binary is also shipped in
    golang-golang-x-tools now. So no longer recommend users to read doc
    with godoc. These html files can also be read in plain browsers.
  * Replace dpkg-parsechangelog with dpkg pkg-info.mk
  * Try to enable tests on armel and ppc64.
    No comments say why it doesn't work
  * Remove nocheck detection as debhelper respects it since compat 13
  * Remove override_dh_missing as fail-missing is default in compat 13

 -- Shengjing Zhu <zhsj@debian.org>  Sun, 18 Apr 2021 03:56:41 +0800

golang-1.16 (1.16-1) unstable; urgency=medium

  * New upstream version 1.16
  * debian/control{.in,}: Change Section from devel to golang
  * Add myself to Uploaders

 -- Anthony Fok <foka@debian.org>  Thu, 18 Feb 2021 00:02:53 -0700

golang-1.16 (1.16~rc1-1) unstable; urgency=medium

  * Team upload.
  * New upstream major version.
    - Drop 0004-cmd-dist-fix-build-failure-of-misc-cgo-test-on-arm64.patch
      which was replaced by https://go-review.googlesource.com/c/go/+/262357/
      and cherry-picked as b3f7f60 for go1.16 upstream
    - Refresh remaining patches
  * Update Standards-Version to 4.5.1, no changes needed

 -- Anthony Fok <foka@debian.org>  Mon, 08 Feb 2021 17:43:41 -0700

golang-1.15 (1.15.8-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.15.8
  * Skip userns tests in schroot.
    When schroot is using overlayfs, it fails to detect it as chroot.

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 05 Feb 2021 20:51:44 +0800

golang-1.15 (1.15.7-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.15.7
    + crypto/elliptic: incorrect operations on the P-224 curve
      CVE-2021-3114

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 23 Jan 2021 01:59:14 +0800

golang-1.15 (1.15.6-1) unstable; urgency=medium

  * Team upload.

  [ Balint Reczey ]
  * cmd/dist: increase default timeout scale for arm (LP: #1893640)

  [ Shengjing Zhu ]
  * New upstream version 1.15.6
  * Drop CGO_LDFLAGS patch, fixed in go1.15.6

 -- Shengjing Zhu <zhsj@debian.org>  Sun, 13 Dec 2020 18:27:59 +0800

golang-1.15 (1.15.5-2) unstable; urgency=medium

  * Team upload.
  * Backport patch to fix usability regression in go1.15.5
    cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist
    https://github.com/golang/go/issues/42567

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 18 Nov 2020 00:46:08 +0800

golang-1.15 (1.15.5-1) unstable; urgency=medium

  * New upstream version 1.15.5.

 -- Michael Hudson-Doyle <mwhudson@debian.org>  Fri, 13 Nov 2020 09:40:16 +1300

golang-1.15 (1.15.4-1) unstable; urgency=medium

  * New upstream version 1.15.4.

 -- Michael Hudson-Doyle <mwhudson@debian.org>  Tue, 10 Nov 2020 10:48:51 +1300

golang-1.15 (1.15.2-1) unstable; urgency=medium

  * New upstream version 1.15.2.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Tue, 15 Sep 2020 09:51:42 +1200

golang-1.15 (1.15-2) unstable; urgency=medium

  * Team upload.
  * Backport fix for arm64 cgo test
    https://go-review.googlesource.com/c/go/+/237858

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 27 Aug 2020 13:44:43 +0800

golang-1.15 (1.15-1) unstable; urgency=medium

  * New upstream version 1.15

 -- Dr. Tobias Quathamer <toddy@debian.org>  Tue, 25 Aug 2020 19:59:24 +0200

golang-1.15 (1.15~rc2-1) unstable; urgency=medium

  * New upstream version 1.15~rc2
    - encoding/binary: ReadUvarint and ReadVarint can read an unlimited
      number of bytes from invalid inputs. CVE-2020-16845

 -- Dr. Tobias Quathamer <toddy@debian.org>  Sun, 09 Aug 2020 16:12:45 +0200

golang-1.15 (1.15~rc1-1) unstable; urgency=medium

  [ Shengjing Zhu ]
  * Backport patches to fix the FPU ABI problems for mips32
    https://go-review.googlesource.com/c/go/+/237058/

  [ Dr. Tobias Quathamer ]
  * New upstream version 1.15~rc1
    - Refresh patches
    - net/http: Expect 100-continue panics in httputil.ReverseProxy.
      See https://github.com/golang/go/issues/34902, fixes CVE-2020-15586

 -- Dr. Tobias Quathamer <toddy@debian.org>  Mon, 03 Aug 2020 21:22:44 +0200

golang-1.15 (1.15~beta1-2) unstable; urgency=medium

  * Source-only upload.

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 17 Jun 2020 17:17:08 +0200

golang-1.15 (1.15~beta1-1) unstable; urgency=medium

  * New upstream major version.
    - Drop patch to fix FTBFS on $HOME managed with git, has been
      applied upstream.
    - Refresh remaining patches

 -- Dr. Tobias Quathamer <toddy@debian.org>  Mon, 15 Jun 2020 21:40:49 +0200

golang-1.14 (1.14.4-1) unstable; urgency=medium

  * New upstream version 1.14.4
    - Refresh patches

 -- Dr. Tobias Quathamer <toddy@debian.org>  Mon, 15 Jun 2020 21:19:41 +0200

golang-1.14 (1.14.3-2) unstable; urgency=medium

  * Increase the test timeout that made some builds succeed
    there on slow hardware (such as emulated riscv64).
    Thanks to Gianfranco Costamagna (Closes: #960759)

 -- Dr. Tobias Quathamer <toddy@debian.org>  Sat, 16 May 2020 14:32:28 +0200

golang-1.14 (1.14.3-1) unstable; urgency=medium

  * New upstream version 1.14.3
  * Use debhelper v13

 -- Dr. Tobias Quathamer <toddy@debian.org>  Fri, 15 May 2020 15:24:43 +0200

golang-1.14 (1.14.2-1) unstable; urgency=medium

  * New upstream version 1.14.2

 -- Dr. Tobias Quathamer <toddy@debian.org>  Fri, 10 Apr 2020 14:34:21 +0200

golang-1.14 (1.14.1-1) unstable; urgency=medium

  * New upstream version 1.14.1
    - Add new patch to fix FTBFS on $HOME managed with git.
      Thanks to Guillem Jover <gjover@sipwise.com> (Closes: #953276)

 -- Dr. Tobias Quathamer <toddy@debian.org>  Sat, 21 Mar 2020 14:01:31 +0100

golang-1.14 (1.14-2) unstable; urgency=medium

  * Fix FTBFS if built twice in a row.
    Some paths of autogenerated files have been changed upstream,
    so that the removal of those files after the build did no
    longer succeed.
    Thanks to Guillem Jover (Closes: #953277)
  * Update Standards-Version to 4.5.0, no changes needed

 -- Dr. Tobias Quathamer <toddy@debian.org>  Mon, 09 Mar 2020 14:00:39 +0100

golang-1.14 (1.14-1) unstable; urgency=medium

  * New upstream version 1.14

 -- Dr. Tobias Quathamer <toddy@debian.org>  Tue, 25 Feb 2020 21:33:50 +0100

golang-1.14 (1.14~rc1-1) unstable; urgency=medium

  * New upstream version 1.14~rc1
    - Fixes CVE-2020-7919
  * Add Breaks: dh-golang (<< 1.43~) to golang-go.
    Thanks to Pirate Praveen <praveen@onenetbeyond.org>
  * Update upstream's signing key
  * Add support for riscv64.
    Thanks to Aurelien Jarno <aurel32@debian.org> (Closes: #950517)

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 05 Feb 2020 23:54:28 +0100

golang-1.14 (1.14~beta1-2) unstable; urgency=medium

  * Source-only upload.
  * Add two more lintian overrides for testdata

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 26 Dec 2019 20:11:44 +0100

golang-1.14 (1.14~beta1-1) unstable; urgency=medium

  * New upstream major version.

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 25 Dec 2019 21:27:46 +0100

golang-1.13 (1.13.5-1) unstable; urgency=medium

  * New upstream version 1.13.5

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 05 Dec 2019 12:27:21 +0100

golang-1.13 (1.13.4-1) unstable; urgency=medium

  * New upstream version 1.13.4
    - Refresh patches

 -- Dr. Tobias Quathamer <toddy@debian.org>  Fri, 01 Nov 2019 21:07:16 +0100

golang-1.13 (1.13.3-1) unstable; urgency=medium

  * New upstream version 1.13.3
    - Refresh patch
    - crypto/dsa: invalid public key causes panic in dsa.Verify.
      Fixes CVE-2019-17596. Closes: #942628
  * Update Standards-Version to 4.4.1, no changes needed

 -- Dr. Tobias Quathamer <toddy@debian.org>  Sat, 19 Oct 2019 13:30:36 +0200

golang-1.13 (1.13.1-1) unstable; urgency=medium

  * New upstream version 1.13.1
    - net/textproto: don't normalize headers with spaces before the colon.
      Fixes CVE-2019-16276. See https://github.com/golang/go/issues/34541
      and Debian bug #941173

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 26 Sep 2019 11:32:14 +0200

golang-1.13 (1.13-1) unstable; urgency=medium

  * New upstream version 1.13
    - Refresh patch
  * Set pristine-tar for gbp to False

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 04 Sep 2019 11:28:07 +0200

golang-1.13 (1.13~rc2-1) unstable; urgency=medium

  * New upstream version 1.13~rc2
    - Remove patch for CVE-2019-9512 and CVE-2019-9514,
      has been applied upstream

 -- Dr. Tobias Quathamer <toddy@debian.org>  Fri, 30 Aug 2019 13:29:21 +0200

golang-1.13 (1.13~rc1-2) unstable; urgency=medium

  * Exclude testdata from dh_makeshlibs.
    Otherwise, the build fails at least on armel and armhf.
  * Apply changes from cme fix dpkg
  * Set Rules-Requires-Root: no

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 22 Aug 2019 15:21:10 +0200

golang-1.13 (1.13~rc1-1) unstable; urgency=medium

  * New upstream version 1.13~rc1
    - Remove patch for CVE-2019-14809, has been applied upstream
  * Use dh_missing instead of deprecated dh_install --fail-missing
  * Do not run dh_dwz, there is no debugging information
  * Use debhelper-compat (= 12)

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 22 Aug 2019 12:48:15 +0200

golang-1.13 (1.13~beta1-3) unstable; urgency=high

  * Fix Denial of Service vulnerabilities in the HTTP/2 implementation.
    https://github.com/golang/go/issues/33631
    CVE-2019-9512, CVE-2019-9514. Closes: #934955
  * Fix multiple Parsing Issues in URL.Parse
    https://github.com/golang/go/issues/29098
    CVE-2019-14809. Closes: #934954

 -- Dr. Tobias Quathamer <toddy@debian.org>  Sat, 17 Aug 2019 23:47:53 +0200

golang-1.13 (1.13~beta1-2) unstable; urgency=medium

  * Set GOCACHE to fix a FTBFS. (See bug #933958)

 -- Dr. Tobias Quathamer <toddy@debian.org>  Fri, 09 Aug 2019 16:40:13 +0200

golang-1.13 (1.13~beta1-1) unstable; urgency=medium

  * New upstream major version.
    - Remove Reproducible-BUILD_PATH_PREFIX_MAP.patch.
      This patch is finally no longer needed with Go 1.13.
      Upstream has implemented a new flag "-trimpath" for the
      command "go build" which either strips the path or
      replaces it in the resulting binaries.
      References:
      https://github.com/golang/go/issues/16860
      https://go-review.googlesource.com/c/go/+/173345/
      https://go-review.googlesource.com/c/go/+/173344/
    - Remove arm64-arm64asm-recognise-new-ssbb-pssbb-mnemonics-fr.patch.
      This patch has been cherry-picked from upstream and is now included.
    - Refresh remaining patches
    - Fix lintian warning: make scripts executable
  * Switch to debhelper-compat, but stay at v11 for now

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 01 Aug 2019 14:21:51 +0200

golang-1.12 (1.12.7-1) unstable; urgency=medium

  * New upstream version 1.12.7
    - Refresh patches
  * Update Standards-Version to 4.4.0, no changes needed

 -- Dr. Tobias Quathamer <toddy@debian.org>  Tue, 09 Jul 2019 14:19:07 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog golang-1.26-doc`.
