CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

devel/tinygo0.42.0_2

Go compiler for small places

Maintainer
gareev@aydar.me
Packages
tinygo 0.42.0_2
Upstream
Higher version available: 0.43.0
CPE
none, CVEs only via VuXML
WWW
https://tinygo.org/
Links
cgit · VuXML

Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE

None. There is no CVE without a VuXML entry for this version.

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (67)

Dag-Erling Smørgrav (des) · 0.42.0_2
various: Bump Go ports for Go 1.26.10 / 1.27.3
d81b7ba3c3
Dag-Erling Smørgrav (des) · 0.42.0_1
various: Bump Go ports
031fc6bfbf
Vladimir Druzenko (vvd) · 0.42.0
devel/tinygo: Update 0.19.0 => 0.42.0, take maintainership

The port has been stuck at 0.19.0 since 2021 and was deprecated on
2026-08-08 along with the other ports pinned to Go 1.25, scheduled for
removal on 2026-09-30.  Upstream 0.42.0 supports Go 1.27 and LLVM 22, so
the pin goes away and with it the reason for the deprecation.

Upstream renamed Makefile to GNUmakefile, dropped the git rev-parse call
and ships the submodule marker files the build checks for, so
files/patch-Makefile is no longer needed at all and the port now builds
unpatched.  wasm-opt is taken from devel/binaryen rather than built from
the bundled copy, and build/release no longer produces a pkg directory.

The bundled LLVM is now a fork of llvm-project carrying the Xtensa
backend, pinned by the commit recorded in llvm-version.txt.  Keeping it
bundled rather than switching to devel/llvm22 is what makes the Xtensa
targets work, ESP32 included.

tinygo resolves GOROOT by running "go" from PATH, which the package does
not provide - USES=go depends on the versioned lang/go126 instead.  The
installed compiler therefore failed with "could not find 'go' command",
0.19.0 included.

Two of the submodule repositories were renamed upstream since the port
was last touched: ARM-software/CMSIS became CMSIS_4, and docker/libtrust
moved to docker-archive-public/docker.libtrust.

Changelog:
https://github.com/tinygo-org/tinygo/blob/v0.42.0/CHANGELOG.md

PR:		298267
Sponsored by:	UNIS Labs (vvd, commit patch)
254020783b
Dag-Erling Smørgrav (des) · 0.19.0_43
various: Bump go ports for go-1.25.14 / 1.26.7
4867821cd6
Dag-Erling Smørgrav (des) · 0.19.0_42
various: Bump go ports for go-1.25.13 / 1.26.6
6d39dcf04e
Dag-Erling Smørgrav (des) · 0.19.0_41
various: Deprecate ports pinned to Go 1.25

Go 1.25 is approaching end-of-life.  Ports that don't build with 1.26
or newer should be updated, or we will have to remove them when we
drop lang/go125 in September.
1110ecab06
Adam Weinberger (adamw) · 0.19.0_41
devel/tinygo: Unmark BROKEN for now

As pointed out by des in the PR referenced below, tinygo isn't broken
yet; it's going to be broken soon (when Go 1.25 leaves the tree), but
does build now.

PR:		297237
932f5bf3a0
Adam Weinberger (adamw) · 0.19.0_41
devel/tinygo: Restrict to Go 1.25 and mark BROKEN

This port has not been updated in years, and the current port version is
incompatible with Go 1.26+. Go 1.26 will become the minimum supported Go
version very soon.

Unless someone adopts this port (the fact that it's so stale suggests
that interest is probably quite low) this port should exit the stage
when Go 1.25 does.

PR:		297237
35a3e5e513
Dag-Erling Smørgrav (des) · 0.19.0_41
various: Bump go ports for go-1.25.12 / 1.26.5
4ea3547132
Dag-Erling Smørgrav (des) · 0.19.0_40
various: Bump go ports for go-1.25.11 / go-1.26.4
dd8dc2a59d
Adam Weinberger (adamw) · 0.19.0_39
various: Bump ports for Go 1.25.10
4e243a83f8
Dag-Erling Smørgrav (des) · 0.19.0_38
various: Bump go ports for go-1.25.9 / 1.26.2
7507e72a84
Adam Weinberger (adamw) · 0.19.0_37
various: Bump ports for Go 1.25.8
a8d318da7c
Adam Weinberger (adamw) · 0.19.0_36
various: Bump ports for Go default 1.24->1.25
97685c1886
Adam Weinberger (adamw) · 0.19.0_35
various: Bump Go ports for 1.24.13
529df949a5
Adam Weinberger (adamw) · 0.19.0_34
various: Bump Go ports for 1.24.12
013f2d30b0
Adam Weinberger (adamw) · 0.19.0_33
various: Bump Go ports for 1.24.11
b24429e3ed
Adam Weinberger (adamw) · 0.19.0_32
various: Bump Go ports for 1.24.10
0dfced16fb
Adam Weinberger (adamw) · 0.19.0_31
various: Bump go ports for go-1.24.9
90f976619b
Adam Weinberger (adamw) · 0.19.0_30
many: Bump dependent ports after go124 update
2e7587aaf8
Adam Weinberger (adamw) · 0.19.0_29
many: Bump go ports for go-1.24.7
31a5a229a7
Adam Weinberger (adamw) · 0.19.0_28
go ports: Bump for 1.24.6
53610681ea
Adam Weinberger (adamw) · 0.19.0_27
many: Bump PORTREVISION for go-1.24.5 update
275975297b
Adam Weinberger (adamw) · 0.19.0_26
various: Bump PORTREVISION after go124-1.24.4 update
94be418de3
Adam Weinberger (adamw) · 0.19.0_25
go: Bump go124-dependent ports

Earlier I bumped the default Go to 1.24. Ports that specify a lower
version will still build with those lower version (for now), so they
don't need a bumping. Instead I'm bumping anything that (now) has go124
as a dependency.
0bdd2ad334
Adam Weinberger (adamw) · 0.19.0_24
go: Bump ports for go124 update
a4e30d4f4f
Adam Weinberger (adamw) · 0.19.0_23
Bump all go ports for yesterday's releases
d0642a6176
Ashish SHUKLA (ashish) · 0.19.0_22
all: Bump after lang/go121 update
aa8c0111bf
Ashish SHUKLA (ashish) · 0.19.0_21
all: Bump after lang/go121 update
c4b51c2028
Ashish SHUKLA (ashish) · 0.19.0_20
all: Bump after lang/go121 update

MFH:		2024Q2
746fa696a1
Ashish SHUKLA (ashish) · 0.19.0_19
all: Bump after lang/go121 update

MFH:		2024Q2
fce0cc3272
Ashish SHUKLA (ashish) · 0.19.0_18
all: Bump after lang/go121 update

MFH:		2024Q2
32b284679a
Max Brazhnikov (makc) · 0.19.0_17
*/*: convert to cmake:indirect

Convert bunch of ports to USES=cmake:indirect
43d9a1336d
Muhammad Moinur Rahman (bofh) · 0.19.0_17
lang/go: Change DEFAULT to 1.21

PR:		277776
Approved by:	portmgr (exp-run)
a5a000df3b
Ashish SHUKLA (ashish) · 0.19.0_16
all: Bump PORTREVISION after lang/go* update

PR:		276530
7e5aa2085f
Ashish SHUKLA (ashish) · 0.19.0_15
all: Bump PORTREVISION after lang/go* update

PR:		274405
0505b712df
Dmitri Goutnik (dmgk) · 0.19.0_14
all: Bump PORTREVISION after lang/go* update
8e4bc57934
Dmitri Goutnik (dmgk) · 0.19.0_13
all: Bump PORTREVISION after lang/go{119,120} update
09b993031a
Dmitri Goutnik (dmgk) · 0.19.0_12
all: Bump PORTREVISION after lang/go{119,120} update
ff40d94c1d
Dmitri Goutnik (dmgk) · 0.19.0_11
all: Bump PORTREVISION after Go ports update
09079730e9
Dmitri Goutnik (dmgk) · 0.19.0_10
all: Bump PORTREVISION after lang/go{119,120} update
56b5ec772f
Dmitri Goutnik (dmgk) · 0.19.0_9
all: Bump PORTREVISION after GO_DEFAULT update.
2297efc51b
Dmitri Goutnik (dmgk) · 0.19.0_8
all: Bump PORTVERSION after lang/go{118,119} update
3b383d833a
Dmitri Goutnik (dmgk) · 0.19.0_7
all: Bump PORTREVISION after lang/go{118,119} update
d9ad1002d5
Dmitri Goutnik (dmgk) · 0.19.0_6
all: Bump PORTREVISION after lang/go{118,119} update
bde51869ee
Daniel Engberg (diizzy) · 0.19.0_5
*/*: Update path set in BUILD_DEPENDS for CMake

Commit b23ea4e2d2f51b53d8915fe9fd7b4efbdd575e38 changed its location to
devel/cmake-core

Approved by:	portmgr (blanket)
e942e560c4
Dmitri Goutnik (dmgk) · 0.19.0_5
all: Bump PORTREVISION after lang/go{118,119} update
f05c98fffb
Stefan Eßer (se) · 0.19.0_4
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 0.19.0_4
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Dmitri Goutnik (dmgk) · 0.19.0_4
all: Bump PORTREVISION after Go update

Bump Go ports PORTREVISION after GO_DEFAULT and lang/go118 update.
4476f89764