Log message:
go121: update to 1.21.6

go1.21.6 (released 2024-01-09) includes fixes to the compiler, the runtime, and
the crypto/tls, maps, and runtime/pprof packages.

It also includes a fix for a slow memory leak on Linux.

Log message:
go120: update to 1.20.13

go1.20.13 (released 2024-01-09) includes fixes to the runtime and the
crypto/tls package.

Log message:
go121: update to 1.21.5 (security)

This minor release includes 3 security fixes following the security policy:

- net/http: limit chunked data overhead

  A malicious HTTP sender can use chunk extensions to cause a receiver reading
  from a request or response body to read many more bytes from the network than
  are in the body.

  A malicious HTTP client can further exploit this to cause a server to
  automatically read a large amount of data (up to about 1GiB) when a handler
  fails to read the entire body of a request.

  Chunk extensions are a little-used HTTP feature which permit including
  additional metadata in a request or response body sent using the chunked
  encoding. The net/http chunked encoding reader discards this metadata. A
  sender can exploit this by inserting a large metadata segment with each byte
  transferred. The chunk reader now produces an error if the ratio of real body
  to encoded bytes grows too small.

  Thanks to Bartek Nowotarski for reporting this issue.
  This is CVE-2023-39326 and Go issue https://go.dev/issue/64433.

- cmd/go: go get may unexpectedly fallback to insecure git

  Using go get to fetch a module with the ".git" suffix may unexpectedly
  fallback to the insecure "git://" protocol if the module is \ 
unavailable via
  the secure "https://" and "git+ssh://" protocols, even if \ 
GOINSECURE is not
  set for said module. This only affects users who are not using the module
  proxy and are fetching modules directly (i.e. GOPROXY=off).

  Thanks to David Leadbeater for reporting this issue.
  This is CVE-2023-45285 and Go issue https://go.dev/issue/63845.

- path/filepath: retain trailing \ when cleaning paths like \\?\c:\

  Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume
  name in Windows paths starting with \\?\, resulting in
  filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other
  effects). The previous behavior has been restored.

  This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028.

Log message:
go120: update to 1.20.12 (security)

This minor release includes 3 security fixes following the security policy:

- net/http: limit chunked data overhead

  A malicious HTTP sender can use chunk extensions to cause a receiver reading
  from a request or response body to read many more bytes from the network than
  are in the body.

  A malicious HTTP client can further exploit this to cause a server to
  automatically read a large amount of data (up to about 1GiB) when a handler
  fails to read the entire body of a request.

  Chunk extensions are a little-used HTTP feature which permit including
  additional metadata in a request or response body sent using the chunked
  encoding. The net/http chunked encoding reader discards this metadata. A
  sender can exploit this by inserting a large metadata segment with each byte
  transferred. The chunk reader now produces an error if the ratio of real body
  to encoded bytes grows too small.

  Thanks to Bartek Nowotarski for reporting this issue.
  This is CVE-2023-39326 and Go issue https://go.dev/issue/64433.

- cmd/go: go get may unexpectedly fallback to insecure git

  Using go get to fetch a module with the ".git" suffix may unexpectedly
  fallback to the insecure "git://" protocol if the module is \ 
unavailable via
  the secure "https://" and "git+ssh://" protocols, even if \ 
GOINSECURE is not
  set for said module. This only affects users who are not using the module
  proxy and are fetching modules directly (i.e. GOPROXY=off).

  Thanks to David Leadbeater for reporting this issue.
  This is CVE-2023-45285 and Go issue https://go.dev/issue/63845.

- path/filepath: retain trailing \ when cleaning paths like \\?\c:\

  Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume
  name in Windows paths starting with \\?\, resulting in
  filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other
  effects). The previous behavior has been restored.

  This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028.

Log message:
go: Add support for GO_VERSION_REQD.

This isn't full multi support like other languages yet, but for now simply a
way for a package to indicate that it requires a specific version of go.

Useful for things like wireguard-go which currently do not build with 1.21.

Log message:
Update go120 to 1.20.11 and go121 to 1.21.4 (security).

These minor releases include 2 security fixes following the security policy:

- path/filepath: recognize \??\ as a Root Local Device path prefix.

  On Windows, a path beginning with \??\ is a Root Local Device path equivalent
  to a path beginning with \\?\. Paths with a \??\ prefix may be used to access
  arbitrary locations on the system. For example, the path \??\c:\x is
  equivalent to the more common path c:\x.

  The filepath package did not recognize paths with a \??\ prefix as special.

  Clean could convert a rooted path such as \a\..\??\b into
  the root local device path \??\b. It will now convert this
  path into .\??\b.

  IsAbs did not report paths beginning with \??\ as absolute.
  It now does so.

  VolumeName now reports the \??\ prefix as a volume name.

  Join(`\`, `??`, `b`) could convert a seemingly innocent
  sequence of path elements into the root local device path
  \??\b. It will now convert this to \.\??\b.

  This is CVE-2023-45283 and https://go.dev/issue/63713.

- path/filepath: recognize device names with trailing spaces and superscripts

  The IsLocal function did not correctly detect reserved names in some cases:

  reserved names followed by spaces, such as "COM1 ".
  "COM" or "LPT" followed by a superscript 1, 2, or 3.
  IsLocal now correctly reports these names as non-local.

  This is CVE-2023-45284 and https://go.dev/issue/63713.

Log message:
Set Go 1.21 as the default Go version.

I did a verification bulk build with this change and updated all the
packages that were broken by this (kubo, ipget, caddy, etc.), so I hope
that this does not introduce any breakage.

Log message:
go120: update to 1.20.10 (security)

net/http: rapid stream resets can cause excessive work

A malicious HTTP/2 client which rapidly creates requests and
immediately resets them can cause excessive server resource consumption.
While the total number of requests is bounded to the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

HTTP/2 servers now bound the number of simultaneously executing
handler goroutines to the stream concurrency limit. New requests
arriving when at the limit (which can only happen after the client
has reset an existing, in-flight request) will be queued until a
handler exits. If the request queue grows too large, the server
will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 v0.17.0,
for users manually configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests)
per HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
This is also tracked by CVE-2023-44487.

Log message:
go121: update to 1.21.3 (security)

1.21.3

net/http: rapid stream resets can cause excessive work

A malicious HTTP/2 client which rapidly creates requests and
immediately resets them can cause excessive server resource consumption.
While the total number of requests is bounded to the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.

HTTP/2 servers now bound the number of simultaneously executing
handler goroutines to the stream concurrency limit. New requests
arriving when at the limit (which can only happen after the client
has reset an existing, in-flight request) will be queued until a
handler exits. If the request queue grows too large, the server
will terminate the connection.

This issue is also fixed in golang.org/x/net/http2 v0.17.0,
for users manually configuring HTTP/2.

The default stream concurrency limit is 250 streams (requests)
per HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.

This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
This is also tracked by CVE-2023-44487.

1.21.2

cmd/go: line directives allows arbitrary execution during build

"//line" directives can be used to bypass the restrictions on \ 
"//go:cgo_"
directives, allowing blocked linker and compiler flags to be passed during
compliation. This can result in unexpected execution of arbitrary code when
running "go build". The line directive requires the absolute path of \ 
the file in
which the directive lives, which makes exploting this issue significantly more
complex.

This is CVE-2023-39323 and Go issue https://go.dev/issue/63211.

Log message:
go120: update to 1.20.9 (security).

cmd/go: line directives allows arbitrary execution during build

"//line" directives can be used to bypass the restrictions on \ 
"//go:cgo_"
directives, allowing blocked linker and compiler flags to be passed during
compliation. This can result in unexpected execution of arbitrary code when
running "go build". The line directive requires the absolute path of \ 
the file in
which the directive lives, which makes exploting this issue significantly more
complex.

This is CVE-2023-39323 and Go issue https://go.dev/issue/63211.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.20.9