Log message:
Update go118 to 1.18.3

This minor release includes 4 security fixes following the security policy
<https://go.dev/security>:

   - crypto/rand: rand.Read hangs with extremely large buffers

   On Windows, rand.Read will hang indefinitely if passed a buffer larger
   than 1 << 32 - 1 bytes.

   Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go
   toolset, for reporting this issue.

   This is CVE-2022-30634 and Go issue https://go.dev/issue/52561.

   - crypto/tls: session tickets lack random ticket_age_add

   Session tickets generated by crypto/tls did not contain a randomly
   generated ticket_age_add. This allows an attacker that can observe TLS
   handshakes to correlate successive connections by comparing ticket ages
   during session resumption.

   Thanks to GitHub user @nervuri for reporting this.

   This is CVE-2022-30629 and Go issue https://go.dev/issue/52814.

   - os/exec: empty Cmd.Path can result in running unintended binary on
   Windows

   If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput
   are executed when Cmd.Path is unset and, in the working directory, there
   are binaries named either "..com" or "..exe", they will \ 
be executed.

   Thanks to Chris Darroch (chrisd8088@github.com), brian m. carlson (
   bk2204@github.com), and Mikhail Shcherbakov (https://twitter.com/yu5k3)
   for reporting this.

   This is CVE-2022-30580 and Go issue https://go.dev/issue/52574.

   - path/filepath: Clean(`.\c:`) returns `c:` on Windows

   On Windows, the filepath.Clean function could convert an invalid path to
   a valid, absolute path. For example, Clean(`.\c:`) returned `c:`.

   Thanks to Unrud for reporting this issue.

   This is CVE-2022-29804 and Go issue https://go.dev/issue/52476.

Log message:
Update go117 to 1.17.11

This minor release includes 4 security fixes following the security policy
<https://go.dev/security>:

   - crypto/rand: rand.Read hangs with extremely large buffers

   On Windows, rand.Read will hang indefinitely if passed a buffer larger
   than 1 << 32 - 1 bytes.

   Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go
   toolset, for reporting this issue.

   This is CVE-2022-30634 and Go issue https://go.dev/issue/52561.

   - crypto/tls: session tickets lack random ticket_age_add

   Session tickets generated by crypto/tls did not contain a randomly
   generated ticket_age_add. This allows an attacker that can observe TLS
   handshakes to correlate successive connections by comparing ticket ages
   during session resumption.

   Thanks to GitHub user @nervuri for reporting this.

   This is CVE-2022-30629 and Go issue https://go.dev/issue/52814.

   - os/exec: empty Cmd.Path can result in running unintended binary on
   Windows

   If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput
   are executed when Cmd.Path is unset and, in the working directory, there
   are binaries named either "..com" or "..exe", they will \ 
be executed.

   Thanks to Chris Darroch (chrisd8088@github.com), brian m. carlson (
   bk2204@github.com), and Mikhail Shcherbakov (https://twitter.com/yu5k3)
   for reporting this.

   This is CVE-2022-30580 and Go issue https://go.dev/issue/52574.

   - path/filepath: Clean(`.\c:`) returns `c:` on Windows

   On Windows, the filepath.Clean function could convert an invalid path to
   a valid, absolute path. For example, Clean(`.\c:`) returned `c:`.

   Thanks to Unrud for reporting this issue.

   This is CVE-2022-29804 and Go issue https://go.dev/issue/52476.

Log message:
go118: update to 1.18.2 (security)

go1.18.2 (released 2022-05-10) includes security fixes to the syscall package,
as well as bug fixes to the compiler, runtime, the go command, and the
crypto/x509, go/types, net/http/httptest, reflect, and sync/atomic packages.
See the Go 1.18.2 milestone on our issue tracker for details.

Log message:
go117: update to 1.17.10 (security)

go1.17.10 (released 2022-05-10) includes security fixes to the syscall package,
as well as bug fixes to the compiler, runtime, and the crypto/x509 and
net/http/httptest packages. See the Go 1.17.10 milestone on our issue tracker
for details.

Log message:
go: make 1.18 the default version

I did a bulk build and identified 5 packages that would break (apisprout, caddy,
go-staticcheck, gvproxy and restish) and fixed them.

Please email tech-pkg@ if you find other breakage!

Log message:
go118: update to 1.18.1

This minor release includes three security fixes following the security policy:

- encoding/pem: fix stack overflow in Decode

  A large (more than 5 MB) PEM input can cause a stack overflow in Decode,
  leading the program to crash.

  Thanks to Juho Nurminen of Mattermost who reported the error.

  This is CVE-2022-24675 and https://go.dev/issue/51853.

- crypto/elliptic: tolerate all oversized scalars in generic P-256

  A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or
  P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and
  crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.

  This was discovered thanks to a Project Wycheproof test vector.

  This is CVE-2022-28327 and https://go.dev/issue/52075.

- crypto/x509: non-compliant certificates can cause a panic in Verify on macOS \ 
in Go 1.18

  Verifying certificate chains containing certificates which are not compliant
  with RFC 5280 causes Certificate.Verify to panic on macOS.

  These chains can be delivered through TLS and can cause a crypto/tls or
  net/http client to crash.

  Thanks to Tailscale for doing weird things and finding this.

  This is CVE-2022-27536 and https://go.dev/issue/51759.

Log message:
go117: update to 1.17.9

This minor release includes three security fixes following the security policy:

- encoding/pem: fix stack overflow in Decode

  A large (more than 5 MB) PEM input can cause a stack overflow in Decode,
  leading the program to crash.

  Thanks to Juho Nurminen of Mattermost who reported the error.

  This is CVE-2022-24675 and https://go.dev/issue/51853.

- crypto/elliptic: tolerate all oversized scalars in generic P-256

  A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or
  P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and
  crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.

  This was discovered thanks to a Project Wycheproof test vector.

  This is CVE-2022-28327 and https://go.dev/issue/52075.

- crypto/x509: non-compliant certificates can cause a panic in Verify on macOS \ 
in Go 1.18

  Verifying certificate chains containing certificates which are not compliant
  with RFC 5280 causes Certificate.Verify to panic on macOS.

  These chains can be delivered through TLS and can cause a crypto/tls or
  net/http client to crash.

  Thanks to Tailscale for doing weird things and finding this.

  This is CVE-2022-27536 and https://go.dev/issue/51759.

Log message:
go118: add Go 1.18 (final release).

Due to how close the freeze is, this will not be the default for the next
quarterly release.

There are lots of news, including support for Generics. Read the release
notes for details.

Log message:
lang/go: Fix bootstrap on macOS Monterrey

Darwin 12 eliminated a kernel feature needed by go 1.10 and earlier.
This patch makes Darwin 12 boostrap using go-bin rather than go14.

Log message:
Update go117 to 1.17.8 (security).

This minor release includes a security fix following the security policy:

regexp: stack exhaustion compiling deeply nested expressions

On 64-bit platforms, an extremely deeply nested expression can cause
regexp.Compile to cause goroutine stack exhaustion, forcing the program to
exit. Note this applies to very large expressions, on the order of 2MB.

Thanks to Juho Nurminen of Mattermost for reporting this.

This is CVE-2022-24921 and https://go.dev/issue/51112.