This is the latest 1.12 minor release at the time of writing. We are not
yet upgrading to Go 1.13 because it ends support for MacOS 10.10 and
earlier (Yosemite) and for versions of FreeBSD prior to 11.2, and so we
need to make that switch with care to properly phase those out as
supported platforms in Terraform too.
This is a minor release of Go that does not include any changes that
affect Terraform's behavior.
This does include a fix for golang/go#31084 that could potentially affect
HCL arithmetic (via math/big) on aarch64, but we do not currently build
Terraform for aarch64 so it cannot have affected any previous releases.
This this includes some security fixes that don't impact Terraform along
with a number of general improvements and fixes in the Go toolchain that
don't appear to affect Terraform behavior.
- URL parsing (such as in the "source" argument in a "module" block) now
validates more strictly the port portion, rejecting non-numeric ports.
Previously this could potentially lead to parts of the URL being
silently ignored.
- The temporary callback server for the forthcoming OAuth client
implementation in "terraform login" would otherwise have been vulnerable
to local (on the same host) denial of service attacks, which is not
a common attack vector but good to fix anyway.
An earlier commit incorrectly updated some versions in go.mod without also
updating the vendor tree, so this also rolls those back to where they used
to be so that we can roll them forward carefully and make sure the tests
actually pass. (If we just accept these new versions as specified the
tests do not pass, so some work is required to fix those regressions.)
Martin Atkins