CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
Port details

lang/go 1.27_21,2

Meta-port for the default version of the Go programming language

Port info

Maintainer
go@FreeBSD.org
Packages
latest: 1.27_21,2
Upstream
up to date
Last update
to 1.27_21,2 · dd0905142a
Quarterly
2026Q4: 1.26_21,2 28 unaddressed
WWW
https://golang.org
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install go
installs 1.27_21,2 from latest; from quarterly (2026Q4) 1.26_21,2
Port
# cd /usr/ports/lang/go && make install clean
Size
1.5 KiB download · 256 B installed
Depends on
lang/go127 1.27.3
License
NA

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.27_21,21.27_21,2–
FreeBSD 151.27_21,21.27_21,2–
FreeBSD 141.27_21,21.27_21,21.27_21,2

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.26_21,21.26_21,2–
FreeBSD 141.26_21,21.26_21,21.26_21,2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.27_21,2 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-398227.82026-07-08On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link…
CVE-2026-425055.32026-07-08Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted cli…

VuXML only (0)

Listed in VuXML, the packaged version 1.27_21,2 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (21)

Show 21 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (4) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
273568maintainer-feedback? lang/go: ease debugging of ports utilizing goNew2025-09-20
277529maintainer-feedback? lang/go*: doesn't respect MAKE_JOBS_NUMBER while buildingNew2025-07-11
286214merge-quarterly- lang/go: Provide only one go versionIn Progress2025-06-10
283314maintainer-feedback? lang/go Go applications segfault on VM infrastructure reliablyNew2025-01-02

Commits (184)

Julien Laffaye (jlaffaye) · 1.11.3,1
Update to 1.11.3
e9b44ffbb2
Julien Laffaye (jlaffaye) · 1.11.1,1
Update to 1.11.1

PR:		231883
Submitted by:	Dmitri Goutnik <dg@syrec.org>
52cb6b901a
Julien Laffaye (jlaffaye) · 1.11,1
- Update to 1.11 - Scope GO387 port option to i386

PR:		230893
Submitted by:	Dmitri Goutnik <dg@syrec.org>
a699a37fb0
Adam Weinberger (adamw) · 1.10.3,1
Update go to 1.10.3 [1], and enable verbose build [2]

PR:		228857 [1], 229013 [2]
Submitted by:	Dmitri Goutnik [1], adamw [2]
Approved by:	maintainer (jlaffaye)
Exp-run by:	antoine
0b82056c9a
Julien Laffaye (jlaffaye) · 1.10.2,1
Update to 1.10.2

PR:		228253
Submitted by:	Dmitri Goutnik
501a500aeb
Julien Laffaye (jlaffaye) · 1.10.1,1
Update to 1.10.1
558907ff0e
Mathieu Arnold (mat) · 1.10,1
Switch some MASTER_SITES from http/ftp to https.

Also some cleanup of dead entries.

PR:		226203
Submitted by:	Sam H
Sponsored by:	Absolight
37677d32e3
Julien Laffaye (jlaffaye) · 1.10,1
- Update to 1.10
3b52e3a783
Julien Laffaye (jlaffaye) · 1.9.4,1
Update to 1.9.4
a1c7003042
Julien Laffaye (jlaffaye) · 1.9.3,1
- Update to 1.9.3
87dce7ba45
Julien Laffaye (jlaffaye) · 1.9.2,1
Update to 1.9.2
c5bd55c13f
Mark Linimon (linimon) · 1.9.1,1
For ports that are explicitly enabled on armv6, also enable them on armv7.  This has not been tested with an -exp run but should "do no harm".

PR:		221894 (partial)
3ef3461740
Julien Laffaye (jlaffaye) · 1.9.1,1
- Update to 1.9.1
b82796c5f2
Julien Laffaye (jlaffaye) · 1.9,1
Remove .error introduced by error in r434383

Reported by:	Lundin Cahill <lundincahill@gmail.com>
d338c8b8ac
Julien Laffaye (jlaffaye) · 1.9,1
Update to 1.9
9412ea4253
Julien Laffaye (jlaffaye) · 1.8.3,1
Add pkg-plist target

PR:		221759
Submitted by:	smh
c27a3d99ab
Julien Laffaye (jlaffaye) · 1.8.3,1
- Update to 1.8.3
3485c62929
Martin Wilke (miwi) · 1.8.1_1,1
- Fix shebangs - Fix bin/rc in lang/go since we dont have it in base or a port to support it - While in lang/go remove WRKSRC for SHEBANG_FILES - Bump PORTREVISION for package change
f51091ad59
Julien Laffaye (jlaffaye) · 1.8.1,1
Fix build with new shebang checks

PR:		218702
Submitted by:	Kenji Rikitake <kenji@k2r.org>
3e6b6b7704
Julien Laffaye (jlaffaye) · 1.8.1,1
Update to 1.8.1
fe660b8ae5
Antoine Brodin (antoine) · 1.8_1,1
Fix plist

Reported by:	pkg-fallout
316a696c32
Gleb Smirnoff (glebius) · 1.8,1
Use pipe2() syscall. It is available on all supported FreeBSD versions. This makes lang/go not depending on pipe() syscall, this not depending on COMPAT_FREEBSD10 kernel.

This is adjusted version of 0ebaca6ba27534add5930a95acffa9acff182e2b
from the official Go repo.

Approved by:	jlaffaye
58eb4d59ff
Julien Laffaye (jlaffaye) · 1.8,1
- Update to 1.8 - Add option to disable SSE2 [1] - Remove CC when calling make.bash [2]

PR:		210612, 209465
7a844106a4
Julien Laffaye (jlaffaye) · 1.7.5,1
Update to 1.7.5
677146d9f2
Julien Laffaye (jlaffaye) · 1.7.4,1
- Update to 1.7.4

PR:		215465
Submitted by:	wen
6a3078dbd1
Julien Laffaye (jlaffaye) · 1.7.3,1
Update to 1.7.3
0f5fe930cf
Julien Laffaye (jlaffaye) · 1.7.1,1
Update to 1.7.1

PR:		212587
Submitted by:	Larry Rosenman <ler@lerctr.org>
1b61ca8472
Julien Laffaye (jlaffaye) · 1.7,1
Remove EXTRA_PATCHES forgotten in previous commit

PR:		211919
Submitted by:	ler@lerctr.org
22e2803137
Julien Laffaye (jlaffaye) · 1.7,1
- Update to 1.7, based on [1] - Delete now useless patch

PR:		211898 [1]
Submitted by:	roberto [1]
1896b2bfb7
Julien Laffaye (jlaffaye) · 1.6.3_1,1
Update to 1.6.3

Security:	CVE-2016-5386
4d6a906c0f
Baptiste Daroussin (bapt) · 1.6.2_1,1
Use relative symlinks to make the port relocation friendly
c4dfb6416c
Mathieu Arnold (mat) · 1.6.2,1
Move lang/go/files/bsd.go.mk to USES=go.

Reviewed by:	bapt
Sponsored by:	Absolight
Differential Revision:	https://reviews.freebsd.org/D6057
5d7b880ff0
Julien Laffaye (jlaffaye) · 1.6.2,1
- Update to 1.6.2
5009e11706
Julien Laffaye (jlaffaye) · 1.6.1,1
- Update to 1.6.1

Security:	CVE-2016-3958, CVE-2016-3959
0a9684c34e
Mathieu Arnold (mat) · 1.6,1
Remove ${PORTSDIR}/ from dependencies, categories h, i, j, k, and l.

With hat:	portmgr
Sponsored by:	Absolight
a9dcad2fff
Julien Laffaye (jlaffaye) · 1.6,1
- Update to 1.6
ada5686a1f
Julien Laffaye (jlaffaye) · 1.5.3,1
- Update to 1.5.3
cbc8cb4ec4
Steve Wills (swills) · 1.5.1,1
lang/go: fix build on 11i386

Approved by:	jlaffaye (maintainer)
Obtained from:	https://github.com/golang/go/commit/26263354a3d607e1cc6c06be67530dad57f43074
da8e4525a8
Dmitry Marakasov (amdmi3) · 1.5.1,1
Improve shebangfix framework

- Support multiple values in *_OLD_CMD, i.e. we can now fix both "/usr/bin/python" and "/usr/bin/env python" at the same time
- Default *_OLD_CMD values are now always appended, so you don't need to specify them in individual ports
- Add lua support (depends on USES=lua)
- Add more default values, such as "/usr/bin/env foo" for python, perl, bash, ruby and lua
- Shebangfix now matches whole words, e.g. we will no longer (erroneously) replace "/usr/bin/perl5.005" with "${perl_CMD}5.005" (but "/usr/bin/perl -tt" is still (correctly) replaced with "${perl_CMD} -tt")

Note that *_OLD_CMD items containing spaces must now be quoted (e.g. perl_OLD_CMD=/bin/perl /usr/bin/perl "/usr/bin/env perl")

Update shebangfix usage according to new rules in many ports:

- Remove *_OLD_CMD for patterns now replaced by default
- Quote custom *_OLD_CMD which contain spaces

Fix shebangfix usage in many ports (irrelevant to infrastructure change):

- Remove redundant SHEBANG_LANG (no need to duplicate default langs)
- Remove redundant *_CMD (such as python_CMD=${LOCALBASE}/bin/python${PYTHON_VER} when USES=python is present)
- Never use *_OLD_CMD in REINPLACE_CMD matchers, these should always look for exact string

Approved by:	portmgr (bapt)
Differential Revision:	D3756
67971bd0fb
John Marino (marino) · 1.5.1,1
lang/go: adjust PLIST_SUB and bsd.go.mk to support DragonFly

Change hardcoded "freebsd" to variable (OPSYS:tl) to allow DragonFly
to build without patches.

PR:		203006
Approved by:	maintainer
11b141ff1d
John Marino (marino) · 1.5.1,1
lang/go: Restrict if_data8 "extra" patch to FreeBSD

The use of OSVERSION to define EXTRA_PATCHES requires an OPSYS check.
The extra patch in question is not valid for DragonFly.

Approved by:	portmgr (bapt, after technical discussion)
23ba4e0f8f
Julien Laffaye (jlaffaye) · 1.5.1,1
- Update to 1.5.1
7eb1fa0bd9
Julien Laffaye (jlaffaye) · 1.5_1,1
Fix net package on CURRENT

PR:		202504
Submitted by:	Maciej Pasternacki <maciej@pasternacki.net>
8e614fd8ec
Julien Laffaye (jlaffaye) · 1.5,1
Force GOBIN to the empty string.

If GOBIN is already defined in the environment,
it can break ports using bsd.go.mk

PR:		202675
b92eb0deda
Antoine Brodin (antoine) · 1.5,1
Unbreak INDEX on mips/sparc64/ia64 etc.
d2aa1dc74e
Julien Laffaye (jlaffaye) · 1.5,1
Update to 1.5
f85e996695
Julien Laffaye (jlaffaye) · 1.4.2,1
- Update to 1.4.2
2f6989e331
Antoine Brodin (antoine) · 1.4,1
Fix plist on i386
aa097967e6
Julien Laffaye (jlaffaye) · 1.4,1
- Update to 1.4
fbf520bc22
Baptiste Daroussin (bapt) · 1.3.2,1
Fix typo
79aafb2cb5