SUSE-SU-2026:3830-1

SUSE-SU-2026:3830-1 · Security update for go1.27

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Diese Seite zeigt ausgewählte Angaben aus den Quellen. Die vollständige Beschreibung und betroffene Versionen finden Sie in den verlinkten Sicherheitshinweisen.

This update for go1.27 fixes the following issues: - go1.27.0 (released 2026-08-19) is a major release of Go. go1.27.x minor releases will be provided through August 2027. https://github.com/golang/go/wiki/Go-Release-Cycle go1.27 arrives six months after Go 1.26. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before. (bsc#1272545) * Language change: Go 1.27 now supports generic methods: a method declaration may declare its own type parameters. This widely anticipated change allows adding generic functions within the namespace of a particular data type where before one had to declare such functions with a scope of the entire package. * Language change: A key in a struct literal may now be any valid field selector for the struct type, not just a (top-level) field name of the struct. * Language change: Function type inference has been generalized to apply in all contexts where a generic function is assigned to a variable of (or converted to) a matching function type. * Tools: Response file (@file) parsing is now supported for the compile, link, asm, cgo, cover, and pack tools. The response file contains whitespace-separated arguments with support for single-quoted and double-quoted strings, escape sequences, and backslash-newline line continuation. The format is compatible with GCC’s response file implementation to ensure interoperability with existing build systems. * go command: The go command no longer has support for the bzr version control system. It will no longer be able to directly fetch modules hosted on bzr servers. * godebug: Starting with Go 1.27, the go command now recognizes a GODEBUG setting for which support was removed (such as asynctimerchan, see below) if it appears in go.mod files (godebug entries) and .go source files (//go:debug comments). It accepts these settings if they are set to the final default value established before the setting was removed. If they are set to an old value, the go command will fail. This change is in the spirit of the Go 1 compatibility guarantee and allows existing programs that set supported GODEBUG settings to continue to build and run without changes even when the respective setting support has been removed. * go test: go test now invokes the stdversion vet check by default. This reports the use of standard library symbols that are too new for the Go version in force in the referring file, as determined by go directive in go.mod and build tags on the file. * go test: go test -json now annotates 'Action':'output' lines with an optional new field 'OutputType', specifying the type of output. Currently, the possible values include “error”, “error-continue”, and “frame”. See cmd/test2json help for details. * go doc: The go doc command now supports package@version syntax, such as go doc example.com/[email protected]. * go doc: The go doc command now accepts the -ex command-line option to list executable examples of the given package or symbol. When an example name is passed on the command line (such as go doc bytes.ExampleBuffer), go doc now prints the example source code along with comments. * go fix: The go fix command contains several new modernizers (atomictypes, embedlit, slicesbackward, and unsafefuncs). * go fix: The existing fmtappendf analyzer was removed due to stylistic concerns. * go fix: The existing waitgroup analyzer was renamed to waitgroupgo to avoid ambiguity. * go mod tidy: For modules specifying go 1.27 or later in their go.mod file, go mod tidy now automatically merges duplicate require blocks. This ensures the file maintains a clean, standard structure containing at most two require blocks: one for direct dependencies and one for indirect dependencies. * go mod fix: Existing comment blocks attached to dependencies are preserved during this consolidation. If a comment block is associated with a mixed set of directives (containing both direct and indirect dependencies), the comment block is merged and attached to the new direct dependency block. * go mod fix: Previously, if a go.mod file accumulated multiple disjoint require blocks (often due to manual edits, unresolved Git merge conflicts, or legacy upgrades) go mod tidy would leave the extra blocks intact or inadvertently create new ones. The tool now strictly enforces the two-block layout, consolidating disparate requirements into their respective blocks and cleaning up the structure of the module file automatically. * go tool trace: go tool trace’s -http command-line option now restricts the listen address to localhost when passed only a port (e.g., -http=:6060). This change makes go tool trace consistent with the behavior of go tool pprof’s -http flag. To listen on all addresses, explicitly include the specified address (e.g., -http=0.0.0.0:6060). * runtime: Tracebacks for modules with go directives configuring Go 1.27 or later will now include runtime/pprof goroutine labels in the header line. This behavior can be disabled with tracebacklabels=0 GODEBUG setting (added in Go 1.26). This opt-out is expected to be kept indefinitely in case goroutine labels acquire sensitive information that shouldn’t be made available in tracebacks. * runtime: The asynctimerchan GODEBUG setting (added in Go 1.23) has been removed permanently. Channels created by package time are now always unbuffered (synchronous), irrespective of GODEBUG settings. * runtime: Faster memory allocation. The compiler now generates calls to size-specialized memory allocation routines, reducing the cost of some small (<80 byte) memory allocations by up to 30%. Improvements vary depending on the workload, but the overall improvement is expected to be ~1% in real allocation-heavy programs. This causes the binary size to increase by about 60 KB (independent of the workload). Please file an issue if you notice any regressions. You may set GOEXPERIMENT=nosizespecializedmalloc at build time to disable it. This opt-out setting is expected to be removed in Go 1.28. * runtime: Goroutine leak profile. A new profile type that reports leaked goroutines, previously available as an experiment in Go 1.26, is now generally available. The new profile type, named goroutineleak, is supported in the runtime/pprof package. It is also available as the net/http/pprof endpoint /debug/pprof/goroutineleak. A leaked goroutine is a goroutine blocked on some concurrency primitive (channels, sync.Mutex, sync.Cond, etc) that cannot possibly become unblocked. The runtime detects leaked goroutines using the garbage collector: if a goroutine G is blocked on concurrency primitive P, and P is unreachable from any runnable goroutine or any goroutine that those could unblock, then P cannot be unblocked, so goroutine G can never wake up. While it is impossible to detect permanently blocked goroutines in all cases, this approach detects a large class of such leaks. Because this technique builds on reachability, the runtime may fail to identify leaks caused by blocking on concurrency primitives reachable through global variables or the local variables of runnable goroutines. Special thanks to Vlad Saioc at Uber for contributing this work. The goroutineleakprofile GOEXPERIMENT setting is now deleted. * compiler: The compiler now resolves a relative filename in a //line or /*line*/ directive against the directory of the file containing the directive, matching the behavior of go/scanner

Korrektur verfügbar

Veröffentlicht

2026-08-26T14:07:25Z

Aktualisiert

2026-08-31T18:23:12.027500291Z

Technologie-Stack: system

Prüfen Sie Ihren Server →