golang-1.27 (1.27~rc2-1) unstable; urgency=medium

  * New upstream version 1.27~rc2
    - CVE-2026-39822
      os: properly handle trailing slashes in paths in Root
    - CVE-2026-42505
      crypto/tls: omit PSK in ECH outer client hello
  * Mark patch as Forwarded: not-needed

 -- Dr. Tobias Quathamer <toddy@debian.org>  Tue, 07 Jul 2026 23:02:25 +0200

golang-1.27 (1.27~rc1-1) unstable; urgency=medium

  * New upstream version 1.27~rc1
    - Refresh patches

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 25 Jun 2026 10:48:30 +0200

golang-1.26 (1.26.4-1) unstable; urgency=medium

  * New upstream version 1.26.4
    - CVE-2026-27145
      crypto/x509: split candidate hostname only once
    - CVE-2026-42507
      net/textproto: escape arbitrary input when including them in errors
    - CVE-2026-42504
      mime: avoid quadratic complexity in WordDecoder.DecodeHeader

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 04 Jun 2026 14:35:47 +0200

golang-1.26 (1.26.3-2) unstable; urgency=medium

  * Support forcing a minimum go compatibility version for
    GODEBUG via DEB_GOMINCOMPAT.
    Thanks to Helmut Grohne <helmut@subdivi.de>

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 21 May 2026 12:16:31 +0200

golang-1.26 (1.26.3-1) unstable; urgency=medium

  * New upstream version 1.26.3
    - CVE-2026-42501
      cmd/go: malicious module proxy can bypass checksum database
    - CVE-2026-39820
      Well-crafted inputs reaching ParseAddress, ParseAddressList, and
      ParseDate were able to trigger excessive CPU exhaustion and memory
      allocations.
    - CVE-2026-39823
      Vulnerability in which URLs were not correctly escaped inside of a
      <meta> tag's <content> attribute.
    - CVE-2026-33811
      When using LookupCNAME with the cgo DNS resolver, a very long
      CNAME response can trigger a double-free of C memory and a crash.
    - CVE-2026-39826
      If a trusted template author were to write a <script> tag
      containing an empty 'type' attribute or a 'type' attribute with an
      ASCII whitespace, the execution of the template would incorrectly
      escape any data passed into the <script> block.
    - CVE-2026-39817
      The "go tool pack" subcommand (usually used only by the compiler
      as an internal tool with known-good inputs) does not sanitize
      output filenames. Extracting a malicious archive file with the
      "pack" subcommand can write files to arbitrary locations on the
      filesystem.
    - CVE-2026-39819
      The "go bug" command writes to two files with predictable names in
      the system temporary directory (for example, "/tmp"). An attacker
      with access to the temporary directory can create a symlink in one
      of these names, causing "go bug" to overwrite the target of the
      symlink.
    - CVE-2026-42499
      Pathological inputs could cause DoS through consumePhrase when
      parsing an email address according to RFC 5322.
    - CVE-2026-39825
      ReverseProxy can forward queries containing parameters not visible
      to Rewrite functions.

 -- Dr. Tobias Quathamer <toddy@debian.org>  Thu, 07 May 2026 22:46:34 +0200

golang-1.26 (1.26.2-3) unstable; urgency=medium

  * Next attempt at making the package reproducible:
    Change timestamp of "test" directory to one of the files in it,
	  because the differing timestamp is the last bit which prevents
	  the golang package from being reproducible.

 -- Dr. Tobias Quathamer <toddy@debian.org>  Sun, 26 Apr 2026 12:28:10 +0200

golang-1.26 (1.26.2-2) unstable; urgency=medium

  * Make package reproducible.
    Some test files cannot be parsed correctly by dh_strip_nondeterminism,
    because they are corrupted on purpose to test the go library.
    However, the previous approach of excluding all "testdata" file
    paths from dh_strip_nondeterminism resulted in a package which
    cannot be built reproducibly, because some timestamps of directories
    were different. Therefore, we exclude only the specific test files
    which would result in a parsing error of dh_strip_nondeterminism.
  * Remove two alien tags from lintian overrides
  * Remove debian/golang-X.Y-go.lintian-overrides, no longer needed
  * Remove unused lintian overrides

 -- Dr. Tobias Quathamer <toddy@debian.org>  Fri, 24 Apr 2026 17:23:37 +0200

golang-1.26 (1.26.2-1) unstable; urgency=medium

  * New upstream version 1.26.2
    - CVE-2026-32280
      During chain building, the amount of work that is done is not
      correctly limited when a large number of intermediate certificates
      are passed in VerifyOptions.Intermediates, which can lead to a
      denial of service. This affects both direct users of crypto/x509
      and users of crypto/tls.
    - CVE-2026-32281
      Validating certificate chains which use policies is unexpectedly
      inefficient when certificates in the chain contain a very large
      number of policy mappings, possibly causing denial of service.
      This only affects validation of otherwise trusted certificate
      chains, issued by a root CA in the VerifyOptions.Roots CertPool,
      or in the system certificate pool.
  * Set Forwarded in patch headers
  * Update Standards-Version to 4.7.4, no changes needed
  * Use go-X.Y for lintian overrides
  * Remove mismatched lintian override

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 08 Apr 2026 11:04:20 +0200

golang-1.26 (1.26.1-1) unstable; urgency=medium

  * Update to 1.26.1 upstream release
    https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk/m/41DopX_WAAAJ
    - CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
    - CVE-2026-27138: crypto/x509: panic in name constraint checking for
                      malformed certificates
    - CVE-2026-27142: html/template: URLs in meta content attribute actions
                      are not escaped
    - CVE-2026-25679: net/url: reject IPv6 literal not at start of host
    - CVE-2026-27139: os: FileInfo can escape from a Root
  * Drop 0004-Replace-localhostCert-and-localhostKey.patch (obsolete via
    https://github.com/golang/go/commit/c5723195a670a09e64769554163ae12b25839819)

 -- Tianon Gravi <tianon@debian.org>  Fri, 06 Mar 2026 16:41:19 -0800

golang-1.26 (1.26.0-1) unstable; urgency=medium

  * New upstream version 1.26.0
    - Refresh patch

 -- Dr. Tobias Quathamer <toddy@debian.org>  Wed, 11 Feb 2026 16:43:25 +0100

golang-1.26 (1.26~rc3-2) unstable; urgency=medium

  * Skip TestTSAN test on s390x.
    The test consistently fails, and is probably a real bug.
    It's currently being investigated, but until that is
    resolved, we disable the test to be able to build the
    golang package, so it can migrate to testing.
    See https://github.com/golang/go/issues/77289
    and Debian BTS #1126312
  * Update d/copyright
    - Use Comment: as field name in d/copyright
    - Remove src/image/jpeg/idct.go from d/copyright, has been
      removed upstream
    - Remove MPEG license terms, no longer needed
    - Update d/copyright with correct license name.
    - Use Go license for d/rules, just like all other files
      in that directory
    - Update license name from FreeBSD to BSD-2-Clause
    - Add d/lrc.config as license hints for lrc
  * Run wrap-and-sort -astkb
  * Remove Breaks: dh-golang (<< 1.43~), o-o-stable is at 1.51
  * Remove leading '/' from .install files
  * Remove unused lintian overrides
  * Add lintian overrides for golang-X.Y-src
  * Add myself as uploader, somehow I got involved again. :-)

 -- Dr. Tobias Quathamer <toddy@debian.org>  Tue, 10 Feb 2026 00:00:48 +0100

golang-1.26 (1.26~rc3-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.26~rc3
  * Remove Priority: optional from d/control
  * Remove Rules-Requires-Root from d/control
  * Update Standards-Version to 4.7.3

 -- Dr. Tobias Quathamer <toddy@debian.org>  Mon, 09 Feb 2026 10:15:40 +0100

golang-1.26 (1.26~rc2-1) unstable; urgency=medium

  * Initial upload of Go 1.26 (rc2)

 -- Tianon Gravi <tianon@debian.org>  Sat, 24 Jan 2026 00:13:51 -0800

golang-1.25 (1.25.6-1) unstable; urgency=medium

  [ Anshul Singh ]
  * Update to 1.25.5 upstream release
    https://go.dev/doc/devel/release#go1.25.5
    - crypto/x509: excessive resource consumption in printing error string for host certificate validation
    - crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

  [ Tianon Gravi ]
  * Update to 1.25.6 upstream release

    1.25.6: (Closes: #1125916)
    - https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc/m/pQP7Bk0aCQAJ

    - CVE-2025-61728: https://go.dev/issue/77102
      archive/zip: denial of service when parsing arbitrary ZIP archives

    - CVE-2025-61726: https://go.dev/issue/77101
      net/http: memory exhaustion in Request.ParseForm

    - CVE-2025-68121: https://go.dev/issue/77113
      crypto/tls: Config.Clone copies automatically generated session ticket
      keys, session resumption does not account for the expiration of full
      certificate chain

    - CVE-2025-61731: https://go.dev/issue/77100
      cmd/go: bypass of flag sanitization can lead to arbitrary code
      execution

    - CVE-2025-68119: https://go.dev/issue/77099
      cmd/go: unexpected code execution when invoking toolchain

    - CVE-2025-61730: https://go.dev/issue/76443
      crypto/tls: handshake messages may be processed at the incorrect
      encryption level

    - os: allow direntries to have zero inodes on Linux (Closes: #1115301)

    1.25.5: (Closes: #1121847)
    - https://groups.google.com/g/golang-announce/c/8FJoBkPddm4/m/kYpVlPw1CQAJ

    - CVE-2025-61729: https://go.dev/issue/76445
      crypto/x509: excessive resource consumption in printing error string for
      host certificate validation

    - CVE-2025-61727: https://go.dev/issue/76442
      crypto/x509: excluded subdomain constraint does not restrict wildcard
      SANs

    1.25.4:
    - https://groups.google.com/g/golang-announce/c/tVVHm9gnwl8/m/-oTvYIjCAQAJ

  * Fix build with DEB_BUILD_OPTIONS=terse (Closes: #1125464)
    (solution borrowed from xz-utils debian/rules)

 -- Tianon Gravi <tianon@debian.org>  Thu, 22 Jan 2026 23:07:54 -0800

golang-1.25 (1.25.3-1) unstable; urgency=medium

  * Update to 1.25.3 upstream release
    https://go.dev/doc/devel/release#go1.25.3
    - fixes to the crypto/x509 package (https://go.dev/issue/75828)

 -- Tianon Gravi <tianon@debian.org>  Mon, 13 Oct 2025 16:06:52 -0700

golang-1.25 (1.25.2-1) unstable; urgency=medium

  * Add Go 1.25 to acceptable bootstrap versions (Build-Depends)
  * Update upstream signing key
  * Update to 1.25.2 upstream release
    https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI/m/qZN5nc-mBgAJ
    - CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress
    - CVE-2025-58187: crypto/x509: quadratic complexity when checking name constraints
    - CVE-2025-58189: crypto/tls: ALPN negotiation errors can contain arbitrary text
    - CVE-2025-61723: encoding/pem: quadratic complexity when parsing some invalid inputs
    - CVE-2025-47912: net/url: insufficient validation of bracketed IPv6 hostnames
    - CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion
    - CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion
    - CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys
    - CVE-2025-58183: archive/tar: unbounded allocation when parsing GNU sparse map
    - CVE-2025-61724: net/textproto: excessive CPU consumption in Reader.ReadResponse

 -- Tianon Gravi <tianon@debian.org>  Thu, 09 Oct 2025 20:14:29 -0700

golang-1.25 (1.25.1-1) unstable; urgency=medium

  * Update to 1.25.1 upstream release
    - net/http: CrossOriginProtection bypass patterns are over-broad
      (CVE-2025-47910; https://go.dev/issue/75054; Closes: #1116341)

 -- Tianon Gravi <tianon@debian.org>  Sat, 27 Sep 2025 21:09:25 -0700

golang-1.25 (1.25.0-2) unstable; urgency=medium

  [ Tianon Gravi ]
  * Add support for cross-building natively (Closes: #1100436)
    - https://salsa.debian.org/go-team/compiler/golang/-/merge_requests/21
  * Clean up debian/helpers/goenv.sh (notably no more go1.16 support)

  [ Bo YU ]
  * Skip failing TSAN tests on riscv64 (Closes: #1115478)

 -- Tianon Gravi <tianon@debian.org>  Fri, 19 Sep 2025 21:11:23 -0700

golang-1.25 (1.25.0-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 1.25.0.

 -- Anshul Singh <anshul.singh@canonical.com>  Fri, 08 Aug 2025 05:13:23 +0000

golang-1.24 (1.24.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.1
    + CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (Closes: #1107364)
    + CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows
    + CVE 2025-22874: crypto/x509: usage of ExtKeyUsageAny disables policy validation (Closes: #1107364)
    + CVE-2025-22873: os: Root permits access to parent directory (Closes: #1104816)
  * d/patches: Removed patch 0003 as it's already applied upstream now

 -- Anshul Singh <anshul.singh@canonical.com>  Mon, 16 Jun 2025 17:04:18 +0530

golang-1.24 (1.24.2-2) unstable; urgency=medium

  * Team upload
  * Backport patch to fix SIGSEGV in vgetrandom on Linux 6.11+
    (Closes: #1103345)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 17 Apr 2025 22:45:41 +0800

golang-1.24 (1.24.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.2
    + CVE-2025-22871: net/http: request smuggling through invalid chunked data

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 03 Apr 2025 14:56:38 +0800

golang-1.24 (1.24.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.1
    + CVE-2025-22870: net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass
      using IPv6 zone IDs
  * Install lib directory to golang-X.Y-src package.
    This includes lib/wasm directory which is moved from misc/wasm
    in Go 1.24. (Closes: #1096251)

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 05 Mar 2025 07:58:41 +0800

golang-1.24 (1.24.0-2) unstable; urgency=medium

  * Team upload
  * Add golang-1.24-go to Build-Depends

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 25 Feb 2025 18:09:52 +0800

golang-1.24 (1.24.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 12 Feb 2025 03:00:57 +0800

golang-1.24 (1.24~rc3-2) unstable; urgency=medium

  * Team upload
  * Add binutils-gold to Build-Depends on arm64 (Closes: #1095697)
  * And binutils-gold to Depends for golang-X.Y-go on arm64

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 12 Feb 2025 02:18:15 +0800

golang-1.24 (1.24~rc3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24~rc3
    + CVE-2025-22866: crypto/elliptic: timing sidechannel for P-256 on ppc64le
    + CVE-2025-22867: cmd/go: arbitrary code execution during build on darwin

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 07 Feb 2025 21:01:51 +0800

golang-1.24 (1.24~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24~rc2
  * Revert "Backport patch to fix tests using expired certificates"

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 21 Jan 2025 14:14:07 +0800

golang-1.24 (1.24~rc1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.24~rc1
  * Bump minimal bootstrap Go version to 1.22
  * Backport patch to fix tests using expired certificates

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 07 Jan 2025 14:33:53 +0800

golang-1.23 (1.23.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.4

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 04 Dec 2024 08:34:52 +0800

golang-1.23 (1.23.3-2) unstable; urgency=medium

  * Team upload
  * Running regression autopkgtest with root

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 12 Nov 2024 17:15:48 +0800

golang-1.23 (1.23.3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.3
  * Switch to versioned golang-1.XX-go packages for building.
    Break circular loop with golang-defaults metapackage (Closes: #1081647)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 07 Nov 2024 15:32:48 +0800

golang-1.23 (1.23.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.2

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 03 Oct 2024 14:40:06 +0800

golang-1.23 (1.23.1-3) unstable; urgency=medium

  * Team upload
  * Increase timeout to 2h in autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 12 Sep 2024 13:21:49 +0800

golang-1.23 (1.23.1-2) unstable; urgency=medium

  * Team upload
  * Increase timeout to 1h in autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 11 Sep 2024 14:05:33 +0800

golang-1.23 (1.23.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.1
    + CVE-2024-34155: go/parser: stack exhaustion in all Parse* functions
    + CVE-2024-34156: encoding/gob: stack exhaustion in Decoder.Decode
    + CVE-2024-34158: go/build/constraint: stack exhaustion in Parse

 -- Shengjing Zhu <zhsj@debian.org>  Mon, 09 Sep 2024 16:26:12 +0800

golang-1.23 (1.23.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 14 Aug 2024 07:05:45 +0800

golang-1.23 (1.23~rc2-2) unstable; urgency=medium

  * Team upload
  * Increase test timeout in autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 19 Jul 2024 16:05:05 +0800

golang-1.23 (1.23~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.23~rc2

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 17 Jul 2024 16:34:37 +0800

golang-1.23 (1.23~rc1-1) unstable; urgency=medium

  * Team upload.

  [ Dr. Tobias Quathamer ]
  * Remove myself from Uploaders

  [ Shengjing Zhu ]
  * New upstream version 1.23~rc1
  * Replace pkg-config with pkgconf

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 02 Jul 2024 16:20:00 +0800

golang-1.22 (1.22.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.4
    + CVE-2024-24789: archive/zip: mishandling of corrupt central directory
      record
    + CVE-2024-24790: net/netip: unexpected behavior from Is methods for
      IPv4-mapped IPv6 addresses

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 05 Jun 2024 07:31:05 +0800

golang-1.22 (1.22.3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.3
    + CVE-2024-24788: net: malformed DNS message can cause infinite loop

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 08 May 2024 17:11:30 +0800

golang-1.22 (1.22.2-2) unstable; urgency=medium

  * Team upload
  * Skip flaky TestCrashDumpsAllThreads on s390x (LP: #2061742)
    https://github.com/golang/go/issues/64650

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 16 Apr 2024 16:13:31 +0800

golang-1.22 (1.22.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.2
    + CVE-2023-45288: http2: close connections when receiving too many headers
  * Revert "Backport patch to fix external link on riscv64" (applied in 1.22.2)

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 04 Apr 2024 04:23:15 +0800

golang-1.22 (1.22.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.1
    + CVE-2024-24783: crypto/x509: Verify panics on certificates with an
      unknown public key algorithm
    + CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm
    + CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of
      sensitive headers and cookies on HTTP redirect
    + CVE-2024-24785: html/template: errors returned from MarshalJSON methods
      may break template escaping
    + CVE-2024-24784: net/mail: comments in display names are incorrectly
      handled
  * Update upstream signing key
  * Backport patch to fix external link on riscv64 (Closes: #1065368)

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 06 Mar 2024 15:09:10 +0800

golang-1.22 (1.22.0-2) unstable; urgency=medium

  * Team upload
  * Skip flaky TestCrashDumpsAllThreads on mips64le

 -- Shengjing Zhu <zhsj@debian.org>  Mon, 26 Feb 2024 17:08:17 +0800

golang-1.22 (1.22.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 21 Feb 2024 16:57:04 +0800

golang-1.22 (1.22~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22~rc2
  * Bump bootstrap Go to 1.20.
    See https://github.com/golang/go/issues/54265
    gccgo only implements Go 1.18 and can't bootstrap Go 1.22 now.
  * Revert "Skip TestUser{Cache,Config}Dir when HOME is not writable"
    This reverts commit 5e8f93837a5d73a391fbbc278a34e5a89f84ca9b.
    Fixed by upstream https://github.com/golang/go/issues/64990

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 30 Jan 2024 17:15:39 +0800

golang-1.22 (1.22~rc1-2) unstable; urgency=medium

  * Skip TestUser{Cache,Config}Dir when HOME is not writable

 -- Shengjing Zhu <zhsj@debian.org>  Sat, 06 Jan 2024 21:26:23 +0800

golang-1.22 (1.22~rc1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.22rc1
  * Build loong64 binaries (Closes: #1055087)
  * Avoid downloading a newer toolchain when bootstrap

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 04 Jan 2024 17:22:48 +0800

golang-1.21 (1.21.5-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.5
    + CVE-2023-39326: net/http: limit chunked data overhead
    + CVE-2023-45285: cmd/go: go get may unexpectedly fallback to insecure git
    + CVE-2023-45283: path/filepath: retain trailing \ when cleaning paths
      like \\?\c:\

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 06 Dec 2023 15:32:23 +0800

golang-1.21 (1.21.4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.4
    + CVE-2023-45283: path/filepath: recognize \??\ as a Root Local Device
      path prefix.
    + CVE-2023-45284: path/filepath: recognize device names with trailing
      spaces and superscripts.

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 08 Nov 2023 03:40:30 +0800

golang-1.21 (1.21.3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.3
    + CVE-2023-44487/CVE-2023-39325: net/http: rapid stream resets can cause
      excessive work

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 11 Oct 2023 14:53:53 +0800

golang-1.21 (1.21.2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.2
    + CVE-2023-39323: cmd/go: line directives allows arbitrary execution during
      build

 -- Shengjing Zhu <zhsj@debian.org>  Fri, 06 Oct 2023 19:35:37 +0800

golang-1.21 (1.21.1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.1
    + CVE-2023-39320: cmd/go: go.mod toolchain directive allows arbitrary
      execution
    + CVE-2023-39318: html/template: improper handling of HTML-like comments
      within script contexts
    + CVE-2023-39319: html/template: improper handling of special tags within
      script contexts
    + CVE-2023-39321/CVE-2023-39322: crypto/tls: panic when processing
      post-handshake message on QUIC connections

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 07 Sep 2023 11:51:55 +0800

golang-1.21 (1.21.0-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21.0

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 09 Aug 2023 14:40:00 +0800

golang-1.21 (1.21~rc4-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21~rc4

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 03 Aug 2023 15:15:53 +0800

golang-1.21 (1.21~rc3-2) unstable; urgency=medium

  * Team upload
  * Add Breaks+Replaces golang-1.21-go (<< 1.21~rc3) on golang-1.21-src
    src/internal/platform/zosarch.go move from golang-1.21-go to
    golang-1.21-src (Closes: #1041412)

 -- Shengjing Zhu <zhsj@debian.org>  Wed, 19 Jul 2023 16:12:19 +0800

golang-1.21 (1.21~rc3-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21~rc3

 -- Shengjing Zhu <zhsj@debian.org>  Mon, 17 Jul 2023 15:20:39 +0800

golang-1.21 (1.21~rc2-2) unstable; urgency=medium

  * Team upload
  * Add autopkgtest

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 29 Jun 2023 16:33:35 +0800

golang-1.21 (1.21~rc2-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21~rc2

 -- Shengjing Zhu <zhsj@debian.org>  Thu, 22 Jun 2023 14:53:06 +0800

golang-1.21 (1.21~rc1-1) unstable; urgency=medium

  * Team upload
  * New upstream version 1.21rc1
  * Install go.env in GOROOT
  * Drop patches
    + 0001-Disable-test-for-UserHomeDir.patch.
      Now the test doesn't fail if HOME dir doesn't exist
      See https://github.com/golang/go/commit/bb4ea80b
    + 0002-Fix-Lintian-warnings-about-wrong-interpreter-path.patch.
      We don't run these scripts, just leave them as is.
    + 0003-cmd-dist-increase-default-timeout-scale-for-arm.patch.
      Upstream has removed arch-specific timeout scale heuristics.
      See https://github.com/golang/go/issues/57117
      We can move the setting to dh-golang.
    + 0004-skip-userns-test-in-schroot-as-well.patch.
      Now the tests doesn't hardcode chroot types.
      See https://github.com/golang/go/commit/09267142

 -- Shengjing Zhu <zhsj@debian.org>  Tue, 20 Jun 2023 17:39:49 +0800

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog golang-1.27-doc`.
