Mirrors/photoprism
1
0
Fork 0
mirror of https://github.com/photoprism/photoprism.git synced 2026-07-22 01:31:21 +00:00
Code Issues Projects Releases Wiki Activity
photoprism/docker/dummy
History
Exact
Michael Mayer 0d960aa36a Go: Bump toolchain to 1.26.3 to clear stdlib CVE advisories 
Upstream Go's May 2026 release patches 8 stdlib advisories that fired
against the previously declared toolchain (1.26.2):

- GO-2026-4918 / CVE-2026-33814 (HTTP/2 SETTINGS_MAX_FRAME_SIZE loop)
- GO-2026-4971 / CVE-2026-39836 (net.Dial NUL byte panic, Windows)
- GO-2026-4976 / CVE-2026-39825 (ReverseProxy URL param forwarding)
- GO-2026-4977 / CVE-2026-42499 (net/mail consumePhrase quadratic)
- GO-2026-4980 / CVE-2026-39826 (html/template escaper bypass XSS)
- GO-2026-4981 / CVE-2026-33811 (net long CNAME crash)
- GO-2026-4982 / CVE-2026-39823 (html/template meta URL escape XSS)
- GO-2026-4986 / CVE-2026-39820 (net/mail consumeComment quadratic)

osv-scanner --recursive now reports 0 advisories. The go directive
floor stays at 1.25.0 so developers without GOTOOLCHAIN=auto can still
build with any Go >= 1.25.0.
2026-05-10 12:49:59 +00:00
..
oidc Go: Bump toolchain to 1.26.3 to clear stdlib CVE advisories 2026-05-10 12:49:59 +00:00
webdav Build: Add shared .telemetry file to opt out of CLI telemetry 2026-04-24 16:42:21 +02:00