CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

lang/go 1.27_21,2

Meta-port for the default version of the Go programming language

Port info

Maintainer
go@FreeBSD.org
Packages
latest: 1.27_21,2
Upstream
up to date
Last update
to 1.27_21,2 · dd0905142a
Quarterly
2026Q4: 1.26_21,2 28 unaddressed
WWW
https://golang.org
Links
cgit · VuXML

Install

Package
# pkg install go
installs 1.27_21,2 from latest; from quarterly (2026Q4) 1.26_21,2
Port
# cd /usr/ports/lang/go && make install clean
Size
1.5 KiB download · 256 B installed
Depends on
lang/go127 1.27.3
License
NA

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.27_21,21.27_21,2–
FreeBSD 151.27_21,21.27_21,2–
FreeBSD 141.27_21,21.27_21,21.27_21,2

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.26_21,21.26_21,2–
FreeBSD 141.26_21,21.26_21,21.26_21,2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.27_21,2 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-398227.82026-07-08On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link…
CVE-2026-425055.32026-07-08Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted cli…

VuXML only (0)

Listed in VuXML, the packaged version 1.27_21,2 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (21)

Show 21 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (4) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
273568maintainer-feedback? lang/go: ease debugging of ports utilizing goNew2025-09-20
277529maintainer-feedback? lang/go*: doesn't respect MAKE_JOBS_NUMBER while buildingNew2025-07-11
286214merge-quarterly- lang/go: Provide only one go versionIn Progress2025-06-10
283314maintainer-feedback? lang/go Go applications segfault on VM infrastructure reliablyNew2025-01-02

Commits (184)

Adam Weinberger (adamw) · 1.27_21,2
many: Bump go ports for 1.26.8 and 1.27.1
dd0905142a
Tijl Coosemans (tijl) · 1.25_20,2
*/*: Use C.UTF-8 locale

Ports 02f27a83b44d fixed the ports tree to the C locale so it would work
correctly in environments where users use a locale that isn't compatible
with the C locale, e.g. xx_YY.UTF-8 where [A-Z] includes more than just
upper case letters.  USE_LOCALE was introduced to let ports use another
locale if they needed it.  The C.UTF-8 locale was created later on to be
mostly compatible with the C locale.

Switch the ports tree locale to C.UTF-8 and remove USE_LOCALE.  The
world has moved to Unicode so all ports either require it or know how to
build correctly in a Unicode environment.

PR:		295945
Exp-run by:	antoine
b6ec06f079
Adam Weinberger (adamw) · 1.25_20,2
various: Bump ports for Go 1.25.8
a8d318da7c
Adam Weinberger (adamw) · 1.25_19,2
various: Bump ports for Go default 1.24->1.25
97685c1886
Adam Weinberger (adamw) · 1.24_18,2
various: Bump Go ports for 1.24.13
529df949a5
Adam Weinberger (adamw) · 1.24_17,2
lang/go: Add bsd.go.mk and use it for go124 and go125

Previously, we used lang/go-devel as a MASTERDIR, but go-devel itself
was really old (essentially 3 years old), and Go doesn't have the
concept of a public "development" version anymore.

Rather than tying modern Go ports to a vestigial version that nobody
should actually use, this commit adds a bsd.go.mk that Go ports can
include. This allows us to get lang/go* Makefiles down to 3 lines.

While here, extend the pkg-descr for both lang/go and the lang/go1*
ports to help users understand what's installing what.

This "new" framework (gently modified from go-devel/Makefile, so all
credit goes to everyone involved in creating that file) provides for
a default pkg-descr, but keeps each port responsible for its own
patches.

No functional changes are intended other than a slightly extended
pkg-descr (not even important enough to bump PORTREVISIONs here). Any
change in behaviour is a bug.
85e71f8497
Adam Weinberger (adamw) · 1.24_17,2
various: Bump Go ports for 1.24.12
013f2d30b0
Adam Weinberger (adamw) · 1.24_16,2
various: Bump Go ports for 1.24.11
b24429e3ed
Adam Weinberger (adamw) · 1.24_15,2
various: Bump Go ports for 1.24.10
0dfced16fb
Po-Chuan Hsieh (sunpoet) · 1.24_14,2
lang/go: Add LICENSE (taken from USES=metaport)

/!\ go-1.24_10,2: Makefile warnings, please consider fixing /!\

Please set LICENSE for this port

PR:		290599
Approved by:	adamw
2d5f05ffae
Adam Weinberger (adamw) · 1.24_14,2
various: Bump go ports for go-1.24.9
90f976619b
Adam Weinberger (adamw) · 1.24_13,2
many: Bump dependent ports after go124 update
2e7587aaf8
Adam Weinberger (adamw) · 1.24_12,2
many: Bump go ports for go-1.24.7
31a5a229a7
Adam Weinberger (adamw) · 1.24_11,2
go ports: Bump for 1.24.6
53610681ea
Adam Weinberger (adamw) · 1.24_10,2
many: Bump PORTREVISION for go-1.24.5 update
275975297b
Adam Weinberger (adamw) · 1.24_9,2
various: Bump PORTREVISION after go124-1.24.4 update
94be418de3
Adam Weinberger (adamw) · 1.24_8,2
go: Bump go124-dependent ports

Earlier I bumped the default Go to 1.24. Ports that specify a lower
version will still build with those lower version (for now), so they
don't need a bumping. Instead I'm bumping anything that (now) has go124
as a dependency.
0bdd2ad334
Adam Weinberger (adamw) · 1.21_7,2
go: Bump ports for go124 update
a4e30d4f4f
Adam Weinberger (adamw) · 1.21_6,2
Bump all go ports for yesterday's releases
d0642a6176
Ashish SHUKLA (ashish)
all: Bump after lang/go121 update
aa8c0111bf
Ashish SHUKLA (ashish)
all: Bump after lang/go121 update
c4b51c2028
Ashish SHUKLA (ashish)
all: Bump after lang/go121 update

MFH:		2024Q2
746fa696a1
Ashish SHUKLA (ashish)
all: Bump after lang/go121 update

MFH:		2024Q2
fce0cc3272
Ashish SHUKLA (ashish)
all: Bump after lang/go121 update

MFH:		2024Q2
32b284679a
Stefan Eßer (se)
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se)
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Dmitri Goutnik (dmgk)
*/*: Pass lang/go* and Mk/Uses/go.mk maintainership

Pass maintainership to the new Go team.

Approved by:	ygy (maintainer, by email)
a3ead31804
Dmitri Goutnik (dmgk)
*/*: Introduce versioned Go ports

- Mk/Uses/go.mk: add support for selecting Go port version in USES=go;
- Mk/bsd.default-versions.mk: add GO_DEFAULT;
- convert lang/go-devel to the master and lang/go{117,118} to slave
  ports;
- add lang/go meta-port that provides go and gofmt symlinks to the
  current default version.

PR:		264336
Reviewed by:	ygy jwb yuri mikael drtr0jan@yandex.ru decke mat
Differential Revision:	https://reviews.freebsd.org/D35346
3012ca2179
Dmitri Goutnik (dmgk) · 1.18.2,1
lang/go: Update to 1.18.2

Changes:	https://go.dev/doc/devel/release#go1.18.minor

PR:		263992
Approved by:	ygy (maintainer)
Security:	a1360138-d446-11ec-8ea1-10c37b4ac2ea
0d862e9490
Dmitri Goutnik (dmgk) · 1.18.1,1
lang/{go,go117,go-devel}: Update bootstrap to go1.17.9

Switch to the newer go1.17.9 bootstrap with backported CL346872
[1,2], fixes ports 259709.

[1] https://go-review.googlesource.com/c/go/+/346872/
[2] https://github.com/golang/go/issues/48112

PR:		263726
PR:		259709
Approved by:	ygy@ (maintainer)
ef05a2efcf
Dmitri Goutnik (dmgk) · 1.18.1,1
lang/go: Update to 1.18.1

Changes:	https://go.dev/doc/devel/release#go1.18.minor

PR:		263723
Approved by:	ygy@ (maintainer)
Security:	61bce714-ca0c-11ec-9cfc-10c37b4ac2ea
5468a006e3
Guangyuan Yang (ygy) · 1.18,1
lang/go: Update to 1.18

Changes:	https://go.dev/doc/devel/release#go1.18
e0e10672e8
Guangyuan Yang (ygy) · 1.17.8,1
lang/go: Update to 1.17.8

Changes:	https://golang.org/doc/devel/release#go1.17.minor
Security:	e2af876f-a7c8-11ec-9a2a-002324b2fba8
9de646aa2d
Guangyuan Yang (ygy) · 1.17.7,1
lang/go: Update to 1.17.7

Changes:	https://golang.org/doc/devel/release#go1.17.minor
Security:	096ab080-907c-11ec-bb14-002324b2fba8
83acd072b4
Guangyuan Yang (ygy) · 1.17.6,1
lang/go: Update to 1.17.6

Changes:	https://go.dev/doc/devel/release#go1.17.minor
4e78b7e346
Guangyuan Yang (ygy) · 1.17.5,1
lang/go: Update to 1.17.5

Changes:	https://golang.org/doc/devel/release#go1.17.minor
Security:	720505fe-593f-11ec-9ba8-002324b2fba8
5e65bf97bb
Guangyuan Yang (ygy) · 1.17.4,1
lang/go: Update to 1.17.4

Changes:	https://golang.org/doc/devel/release#go1.17.minor
66b73ca2e1
Guangyuan Yang (ygy) · 1.17.3_2,1
lang/go, lang/go-devel: Respect CC

PR:		258291
Fixes:		f55607ce7b906bd7886b857f568956880f4281ff
Reported by:	Evgeniy Khramtsov <evgeniy@khramtsov.org>
2309e28d9e
Guangyuan Yang (ygy) · 1.17.3_1,1
lang/go, lang/go-devel: Respect CC

PR:		258291
f55607ce7b
Guangyuan Yang (ygy) · 1.17.3,1
lang/go: Update to 1.17.3

Changes:	https://golang.org/doc/devel/release#go1.17.minor
Security:	930def19-3e05-11ec-9ba8-002324b2fba8
34b8755a42
Guangyuan Yang (ygy) · 1.17.2,1
lang/go: Update to 1.17.2

Changes:	https://golang.org/doc/devel/release#go1.17.minor
Security:	4fce9635-28c0-11ec-9ba8-002324b2fba8
12b9c41159
Rene Ladan (rene) · 1.17.1,1
cleanup: drop support for EOL FreeBSD 11.X

Search criteria used:
- 11.4
- OSREL*
- OSVER*
- *_FreeBSD_11

Input from:
- adridg: devel/qca-legacy
- jbeich: _WITH_DPRINTF, _WITH_GETLINE, GNU bfd workarounds
- sunpoet: security/p5-*OpenSSL*

Reviewed by:	doceng, kde, multimedia, perl, python, ruby, rust
Differential Revision: https://reviews.freebsd.org/D32008
Test Plan: make index
620968a43a
Guangyuan Yang (ygy) · 1.17.1,1
lang/go: Take maintainership
c72a8f3160
Dmitri Goutnik (dmgk) · 1.17.1,1
lang/go: Resign maintainership
be0dbc8dae
Bernhard Froehlich (decke) · 1.17.1,1
lang/go: Add CPE information

Approved by:	portmgr (blanket)
5bee454469
Dmitri Goutnik (dmgk) · 1.17.1,1
lang/go: Update to 1.17.1

Changes:	https://golang.org/doc/devel/release#go1.17.minor
Security:	4ea1082a-1259-11ec-b4fa-dd5a552bdd17
8532f7246f
Dmitri Goutnik (dmgk) · 1.17_2,1
lang/go: correct patch size mismatch

Github seems to be undecided whether
782aa42255163559c5e1c4c2d98c8f28da8cf96b.patch size should be 1111 or
1113 bytes. Give them some time to contemplate and commit this patch to
the repo for now.

PR:		258253
Reported by:	Alex <marcarianalexandru@gmail.com>
Reported by:	Marc Flambard <marc-pub@alluem.fr> (by email)
34c43da970
Dmitri Goutnik (dmgk) · 1.17_1,1
lang/go: mark stacks as non-executable on freebsd (CL346872 backport)

PR:		258241
4e2f244da5
Dmitri Goutnik (dmgk) · 1.17,1
lang/go: Update to 1.17

Changes:	https://golang.org/doc/go1.17
e8b93241fd
Dmitri Goutnik (dmgk) · 1.16.7,1
lang/go: Update to 1.16.7

Changes:	https://golang.org/doc/devel/release#go1.16.minor
Security:	880552c4-f63f-11eb-9d56-7186043316e9
a372ea0aab