Provenance Record

Well-structured 706-word News piece (policy range 400-1200; 706 both raw and with link URLs stripped). Title is 141 characters (cap 150). Separates what the release notes say from what PR #4700, the Go vulnerability entry and PR #4681 say. Explicit unknowns section. No internal links; earlier OpenTofu coverage exists (2026-05/22 on OpenTofu 1.12) and is linked via related_articles in the meta file.

All 9 snapshots exist (HTTP 200, no archive fallback, no suspicious_patterns) and contain real page bodies (none is page chrome only). Hosts github.com, pkg.go.dev, go.dev are already in config/source_allowlist.txt; no allowlist change. source-0 (v1.12.8 release): published 14 Oct 16:20; SECURITY ADVISORIES entry quoted verbatim, links #4700, no CVE named; BUG FIXES entry verbatim (#4648). Live API re-fetch: published_at 2026-10-14T16:20:20Z, body unchanged. source-1 (PR #4700, title 'go.mod: Upgrade to Go 1.26.9 [v1.12 backport]', author apparentlymart, merged 2026-10-14 into v1.12): 'primarily motivated by patching advisory GO-2026-6611, also known as CVE-2026-78669', the attacker-controlled-server sentence, the 'threat model generally expects operators to review dependencies before using them' and 'because operators often review dependencies only after having installed them, before running other commands' quotes, and the #4648 release-together note all verbatim. The CVE identifier is correctly attributed to PR #4700 and the Go entry, not the release notes. source-2 (PR #4681, v1.13 backport, merged 2026-10-14): the 'low-severity advisory ... I propose that we just include it in the v1.13.2 release' sentence is verbatim in the PR description; the article presents it as a proposal by the PR author, not a schedule. source-3 (pkg.go.dev GO-2026-6611): alias CVE-2026-78669; net/http before go1.26.9; net/http/internal/http2 from go1.27.0-0 before go1.27.2; golang.org/x/net/http2 before v0.60.0; summary sentence verbatim; published Oct 08, 2026; no severity field (article asserts none). source-4 (go.dev/doc/devel/release): go1.26.9 and go1.27.2 both released 2026-10-08. source-5 (advisories index): ten GHSA entries counted (vxp5, q7j3, 22w5, pxh5, wcmj, hw5x, r92c, mjcp, w2jf, wpr2); newest GHSA-vxp5-g6gx-r4j2 published Aug 19, 2026, titled 'Excessive resource usage in "tofu init" when interacting with attacker-controlled server'; no October 2026 entry. source-6 (releases page): order v1.12.8, v1.13.1 (Latest, 01 Oct), ...; no v1.13.2. Live API check at review time: no v1.13.2 release; latest are v1.12.8, v1.13.1, v1.12.7, v1.13.0. source-7 (v1.13.1 go.mod): 'go 1.27.1'; source-8 (v1.12.8 go.mod): 'go 1.26.9'; neither shows a toolchain line, and the article states plainly that the build toolchain is an inference. Author status: PR pages show GitHub's 'Contributor' label; MAINTAINERS.md in the repository (not a cited source) lists Martin Atkins @apparentlymart as an Organization Maintainer, so 'maintainer' is true but is not supported by any cited source (clarification filed). Two imprecise statements in the Advisory Index section: 'a different release history' for the August advisory is not shown by the index snapshot; and 'None of the ten is dated October' is literally untrue since GHSA-wpr2-j6gr-pjw9 is dated Oct 3, 2024 (context implies 2026).

Vendor claims are attributed (release notes, PR author, Go vuln DB). Identifier provenance correct. Dates, versions and quotes verified. Only the issues above. The article does not assess OpenTofu 1.11 and says so.

Substantively accurate and carefully attributed on a high-stakes security story. Two recoverable, subordinate imprecisions are covered by a corrections record.