full diff: https://github.com/golang/net/compare/v0.61.0...v0.62.0
This release addresss the following security issues:
- html: avoid quadratic complexity when coalescing text nodes
When coalescing adjacent text nodes in addText and fosterParent,
appending to an existing TextNode's Data via string concatenation
(n.Data += text) reallocated and copied the accumulated string on every
token. Inputs containing many short text runs separated by ignored end
tags (such as "a") caused O(n^2) allocations and byte copies.
Accumulate coalesced text in per-node byte slices during parsing and
materialize Data strings once at the end of parse.
Thanks to Markus Magnuson for reporting this issue.
This is CVE-2026-78661 and Go issue https://go.dev/issue/82224.
- html: check all ancestor namespace transitions when rendering raw text
In childTextNodesAreLiteral, walking up the tree previously stopped at
the nearest foreign ancestor once an HTML integration point was found.
However, that integration point may itself be a descendant of an element
that was foster-parented into a foreign namespace (such as or
fostered under ), causing a parser to resolve the
subtree in a different foreign namespace upon re-parsing the rendered
output.
Continue walking the full ancestor chain and verify that every
transition from a non-empty namespace occurs at an HTML integration
point before emitting literal text.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276) for reporting this issue.
This is CVE-2026-97045 and Go issue https://go.dev/issue/82622.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- cpu: add amd64 v2/v3/v4 feature bits
- darwin: expose setpriority PRIO_DARWIN_* constants
- unix/darwin: add missing pwritev test case on darwin/arm64
- unix/darwin: add O_EXEC and O_SEARCH on darwin
- unix/darwin: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
- unix/linux: don't warn about closed stderr from child process
- unix/linux: unify ppc64x syscall wrappers
- unix: add listns syscall introduced in Linux 6.19
- unix: add Mmsghdr for linux
- unix: add PrctlArg5Ptr
- unix: align the getdents buffer
- unix: extend z/OS support
- unix: keep generated types compilable with current cgo
- unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
- unix: provide linux/sparc64 assembly for syscalls
- unix: return syscall error in *listxattrNS on BSD
- unix: update glibc to 2.44
- unix: update linux to v7.2
- unix: use the stat64 family and fix Stat_t on linux/sparc64
- windows: drop arm
full diff: https://github.com/golang/sys/compare/v0.48.0...v0.49.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Treat the remaining invisible format controls as zero width
- Treat bidi isolates and other invisible format characters as zero width
- Measure ambiguous Latin letters as one cell in East Asian locales
- Fix width mismatches found by the Hegel property tests
- Recognise CJK locales regardless of charset spelling
full diff: https://github.com/mattn/go-runewidth/compare/v0.0.30...v0.0.31
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Wrap: measure grapheme clusters, not runes
- Skip grapheme segmentation for text that cannot form clusters
- Keep strings that are not valid UTF-8 on the segmenter - #111
- Take the rune fast path in the Truncate functions too
full diff: https://github.com/mattn/go-runewidth/compare/v0.0.29...v0.0.30
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Add lzw reader/writer
- ci: test against go1.27.x, drop go1.24.x
- flate: Writer L7-9 with dictionary can emit the dictionary to stream
- gzhttp: limit jitter hash to jitterBuffer bytes
- s2: arm64 assembly encoders, lowered from the amd64 avo program
- s2: clamp the Go EncodeBetter skip to match the assembly
- xpress: add Microsoft XPRESS (MS-XCA) decompression
- xxhash: bound input of non-preemptive assembly
- zstd, huff0: improved arm64 lowering, and narrow two table loads to MOVWQZX
- zstd/huff0: break false partial-register dependencies in seqdec/4X decoders
- zstd/huff0: fold two ISA-gap x86 idioms in the avo arm64 lowering
full diff: https://github.com/klauspost/compress/compare/v1.19.2...v1.20.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- cpu: add ppc64le POWER10 detection
- cpu: add basic support for GOARCH=sparc64
- cpu: disable AVX+ on netbsd/amd64
relates to "runtime: async preemption corrupts AVX (YMM) state on netbsd/amd64"
- internal/cpu: detect RISC-V VLENB when the vector extension is available
- unix: add missing HWTSTAMP_* constants
- unix: add pidfd constants and type
- unix: add IoctlPidfdInfo
- unix: add IPMI interface
- unix: align Ifreq so its union accessors cannot fault
- unix: stop generating sparc termbits from the generic header
- windows: add SO_SNDTIMEO constant for socket options
full diff: https://github.com/golang/sys/compare/v0.47.0...v0.48.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Paweł Gronowski
Sebastiaan van Stijn
Sebastiaan van Stijn