[security] Go 1.25.1 and Go 1.24.7 are released (original) (raw)

Hello gophers,

We have just released Go versions 1.25.1 and 1.24.7, minor point releases.

These minor releases include 1 security fixes following the security policy:

• net/http: CrossOriginProtection bypass patterns are over-broad
  When passing patterns to CrossOriginProtection.AddInsecureBypassPattern,
  requests that would have redirected to those patterns (e.g. without a trailing
  slash) were also exempted, which might be unexpected.
  Thanks to Marco Gazerro for reporting this issue.
  This is CVE-2025-47910 and Go issue https://go.dev/issue/75054.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.25.1

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
git checkout go1.25.1 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Michael and Cherry for the Go team