---
- branch: MAIN
  date: Fri Nov 10 15:39:34 UTC 2023
  files:
  - new: '1.194'
    old: '1.193'
    path: pkgsrc/lang/go/version.mk
    pathrev: pkgsrc/lang/go/version.mk@1.194
    type: modified
  - new: '1.10'
    old: '1.9'
    path: pkgsrc/lang/go120/PLIST
    pathrev: pkgsrc/lang/go120/PLIST@1.10
    type: modified
  - new: '1.12'
    old: '1.11'
    path: pkgsrc/lang/go120/distinfo
    pathrev: pkgsrc/lang/go120/distinfo@1.12
    type: modified
  - new: '1.4'
    old: '1.3'
    path: pkgsrc/lang/go121/PLIST
    pathrev: pkgsrc/lang/go121/PLIST@1.4
    type: modified
  - new: '1.4'
    old: '1.3'
    path: pkgsrc/lang/go121/distinfo
    pathrev: pkgsrc/lang/go121/distinfo@1.4
    type: modified
  id: 20231110T153934Z.1bf3e35d69bb4bd123ef53bdf750b4f55e7e3d92
  log: |
    Update go120 to 1.20.11 and go121 to 1.21.4 (security).

    These minor releases include 2 security fixes following the security policy:

    - path/filepath: recognize \??\ as a Root Local Device path prefix.

      On Windows, a path beginning with \??\ is a Root Local Device path equivalent
      to a path beginning with \\?\. Paths with a \??\ prefix may be used to access
      arbitrary locations on the system. For example, the path \??\c:\x is
      equivalent to the more common path c:\x.

      The filepath package did not recognize paths with a \??\ prefix as special.

      Clean could convert a rooted path such as \a\..\??\b into
      the root local device path \??\b. It will now convert this
      path into .\??\b.

      IsAbs did not report paths beginning with \??\ as absolute.
      It now does so.

      VolumeName now reports the \??\ prefix as a volume name.

      Join(`\`, `??`, `b`) could convert a seemingly innocent
      sequence of path elements into the root local device path
      \??\b. It will now convert this to \.\??\b.

      This is CVE-2023-45283 and https://go.dev/issue/63713.

    - path/filepath: recognize device names with trailing spaces and superscripts

      The IsLocal function did not correctly detect reserved names in some cases:

      reserved names followed by spaces, such as "COM1 ".
      "COM" or "LPT" followed by a superscript 1, 2, or 3.
      IsLocal now correctly reports these names as non-local.

      This is CVE-2023-45284 and https://go.dev/issue/63713.
  module: pkgsrc
  subject: 'CVS commit: pkgsrc/lang'
  unixtime: '1699630774'
  user: bsiegert