[Buildroot] [PATCH v1 1/1] package/go: bump to version 1.26.1

[Julien Olivain]

Hi Christian,

Thanks for the patch. I have few comments, see below.

On 08/03/2026 01:57, Christian Stewart via buildroot wrote:
> For release notes, see:
> https://go.dev/doc/devel/release#go1.26.0

Buildroot has currently go 1.25.7.

The release note mention that it includes security fixes:
https://github.com/golang/go/issues?q=milestone%3AGo1.26.1%20label%3ASecurity

https://www.cve.org/CVERecord?id=CVE-2026-25679
affected from 0 before 1.25.8

https://www.cve.org/CVERecord?id=CVE-2026-27142
affected from 0 before 1.25.8

It also fixes those two issues introduced in go 1.26.0.
https://www.cve.org/CVERecord?id=CVE-2026-27137
https://www.cve.org/CVERecord?id=CVE-2026-27138

So I believe this bump should be marked as a security bump.

Could you confirm it is the case?
If yes, could you send an updated version of the patch
adding those details in the commit log, please?

[...]
> diff --git a/package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash 
> b/package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash
> new file mode 100644
> index 0000000000..edd2e0a8c2
> --- /dev/null
> +++ b/package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash
> @@ -0,0 +1,3 @@
> +# From https://go.dev/dl
> +sha256  
> e988d4a2446ac7fe3f6daa089a58e9936a52a381355adec1c8983230a8d6c59e  
> go1.25.8.src.tar.gz
> +sha256  
> 2d36597f7117c38b006835ae7f537487207d8ec407aa9d9980794b2030cbc067  
> LICENSE

Also, host-go-bootstrap-stage5 are failing with the error:

>>> host-go-bootstrap-stage5 1.25.8 Collecting legal info
ERROR: while checking hashes from 
package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash
ERROR: LICENSE has wrong sha256 hash:
ERROR: expected: 
2d36597f7117c38b006835ae7f537487207d8ec407aa9d9980794b2030cbc067
ERROR: got     : 
911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad
ERROR: Incomplete download, or man-in-the-middle (MITM) attack

Could you fix the license hash, please?

Best regards,

Julien.