← All release notes

September 4, 2026 · Developer Tools, RCC

RCC v21.3.0 released

RCC v21.3.0 is a security release. It updates two Go dependencies for CVEs reported to us, and moves the toolchain to Go 1.25.14 to pick up the current standard library fixes. Scanning v21.2.0 with govulncheck reported 22 known vulnerabilities; this build reports none.

There are no functional changes and no breaking changes in this release. Upgrading is a straight swap.

Dependency updates

Two CVEs were reported against RCC's dependencies:

  • CVE-2026-56852 — golang.org/x/text: norm.Iter can enter an infinite loop when processing input containing invalid UTF-8 bytes. Updated 0.23.0 → 0.41.0.
  • CVE-2026-39824 — golang.org/x/sys: NewNTUnicodeString does not check for string length overflow on Windows NT Unicode strings. Updated 0.32.0 → 0.47.0.

golang.org/x/term was updated 0.31.0 → 0.45.0 alongside these to stay in step with golang.org/x/sys.

Go standard library updates

The Go toolchain moved from 1.25.9 to 1.25.14, which resolves 20 standard library CVEs:

  • crypto/tls — CVE-2026-42505 (Encrypted Client Hello privacy leak), CVE-2026-56862 (post-handshake message limit)
  • crypto/x509 — CVE-2026-27145 (inefficient candidate hostname parsing)
  • html/template — CVE-2026-39826 and CVE-2026-39823 (escaper and meta content URL bypasses), CVE-2026-56858 (JavaScript regexp context tracking)
  • net — CVE-2026-39836 (panic on NUL byte in Dial/LookupPort on Windows), CVE-2026-33811 (crash on long CNAME response)
  • net/http — CVE-2026-33814 (HTTP/2 infinite loop on a bad SETTINGS_MAX_FRAME_SIZE), CVE-2026-56853 (ReadHeaderTimeout on the unencrypted HTTP/2 check), CVE-2026-39825 (ReverseProxy query parameter limit)
  • net/mail — CVE-2026-42499 and CVE-2026-39820 (quadratic string concatenation)
  • net/textproto — CVE-2026-42507 (arbitrary input included in errors without escaping)
  • net/url — CVE-2026-56860 (quadratic complexity in resolvePath)
  • mime — CVE-2026-42504 (quadratic complexity in WordDecoder.DecodeHeader)
  • os — CVE-2026-39822 (root escape via symlink plus trailing slash)
  • encoding/asn1 — CVE-2026-33818 (maximum recursion depth)
  • encoding/xml — CVE-2026-56859 (recursion depth guard during decode)
  • golang.org/x/net/idna — CVE-2026-39821 (ASCII-only Punycode-encoded labels not rejected)

Getting v21.3.0

Signed and pre-built executables are available directly:

  • Windows — rcc.exe
  • macOS (Apple Silicon) — rcc
  • Linux — rcc

macOS and Windows builds are code-signed, and the macOS build is notarized. Note that RCC supports macOS on Apple Silicon only; Intel builds were discontinued in v21.0.0.

The complete changelog ships inside the executable itself — run rcc docs changelog to read the full list of changes for the version you have installed.