go, branch go1.25.1

[release-branch.go1.25] go1.25.1

2025-09-03T17:46:11Z

Change-Id: I93a703d161b821cf7a78934f8711416ac6b00485 Reviewed-on: https://go-review.googlesource.com/c/go/+/700736 Auto-Submit: Gopher Robot TryBot-Bypass: Gopher Robot Reviewed-by: Michael Pratt Reviewed-by: Cherry Mui

[release-branch.go1.25] net/http: require exact match for CrossSiteProtection bypass patterns

2025-08-27T15:45:05Z

Fixes #75160 Updates #75054 Fixes CVE-2025-47910 Change-Id: I6a6a696440c45c450d2cd681f418b01aa0422a60 Reviewed-on: https://go-review.googlesource.com/c/go/+/699276 Reviewed-by: Roland Shoemaker Reviewed-by: Cherry Mui LUCI-TryBot-Result: Go LUCI

[release-branch.go1.25] net: fix WriteMsgUDPAddrPort addr handling on IPv4 sockets

2025-08-26T02:49:59Z

Accept IPv4-mapped IPv6 destination addresses on IPv4 UDP sockets. Fixes #74999. Change-Id: I4624b9b8f861aedcae29e51d5298d23ce1c0f2c7 Reviewed-on: https://go-review.googlesource.com/c/go/+/689976 LUCI-TryBot-Result: Go LUCI Reviewed-by: Mark Freeman Reviewed-by: Damien Neil (cherry picked from commit bdb2d50fdf40706e7d7411f33ade80edac726707) Reviewed-on: https://go-review.googlesource.com/c/go/+/695875 Reviewed-by: Cherry Mui Reviewed-by: Carlos Amedee

[release-branch.go1.25] internal/poll: set the correct file offset in FD.Seek for Windows overlapped handles

2025-08-25T18:19:12Z

Windows doesn't keep the file pointer for overlapped file handles. To work around this, we keep track of the current offset ourselves and use it on every Read/Write operation. When the user calls File.Seek with whence == io.SeekCurrent, it expects that the offset we keep track of is also accounted for, else the the seek'ed value won't match the file pointer seen by the user. Fixes #75083. Change-Id: Ieca7c3779e5349292883ffc293a8474088a4dec7 Reviewed-on: https://go-review.googlesource.com/c/go/+/697275 LUCI-TryBot-Result: Go LUCI Reviewed-by: Damien Neil Reviewed-by: Dmitri Shuralyov (cherry picked from CL 697275) Reviewed-on: https://go-review.googlesource.com/c/go/+/697995

[release-branch.go1.25] runtime: make all synctest bubble violations fatal panics

2025-08-25T18:17:11Z

Unblocking a bubbled goroutine from outside the bubble is an error and panics. Currently, some of those panics are regular panics and some are fatal. We use fatal panics in cases where its difficult to panic without leaving something in an inconsistent state. Change the regular panics (channel and timer operations) to be fatal. This makes our behavior more consistent: All bubble violations are always fatal. More importantly, it avoids introducing new, recoverable panics. A motivating example for this change is the context package, which performs channel operations with a mutex held in the expectation that those operations can never panic. These operations can now panic as a result of a bubble violation, potentially leaving a context.Context in an inconsistent state. For #74837 Fixes #75021 Change-Id: Ie6efd916b7f505c0f13dde42de1572992401f15c Reviewed-on: https://go-review.googlesource.com/c/go/+/696195 Auto-Submit: Damien Neil LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Pratt (cherry picked from commit a8564bd412d4495a6048f981d30d4d7abb1e45a7) Reviewed-on: https://go-review.googlesource.com/c/go/+/696196

[release-branch.go1.25] os/exec: fix incorrect expansion of ".." in LookPath on plan9

2025-08-25T18:15:17Z

The correction in CL 685755 is incomplete for plan9, where path search is performed even on file strings containing "/". By applying filepath.Clean to the argument of validateLookPath, we can check for bogus file strings containing ".." where the later call to filepath.Join would transform a path like "badfile/dir/.." to "badfile" even where "dir" isn't a directory or doesn't exist. For #74466 Fixes #75008 Change-Id: I3f8b73a1de6bc7d8001b1ca8e74b78722408548e Reviewed-on: https://go-review.googlesource.com/c/go/+/693935 Reviewed-by: David du Colombier <0intro@gmail.com> LUCI-TryBot-Result: Go LUCI Reviewed-by: David Chase Reviewed-by: Dmitri Shuralyov (cherry picked from commit 674c5f0edd82b5d1dd5cb44eb4b85830245c151e) Reviewed-on: https://go-review.googlesource.com/c/go/+/698416 Reviewed-by: Cherry Mui

[release-branch.go1.25] cmd/go/internal/gover: fix ModIsPrerelease for toolchain versions

2025-08-20T19:47:59Z

We forgot to call the IsPrerelease function on FromToolchain(vers) rather than on vers itself. IsPrerelase expects a version without the "go" prefix. See the corresponding code in ModIsValid and ModIsPrefix that call FromToolchain before passing the versions to IsValid and IsLang respectively. Fixes #74822 Change-Id: I3cf055e1348e6a9dc0334e414f06fe85eaf78024 Reviewed-on: https://go-review.googlesource.com/c/go/+/691655 LUCI-TryBot-Result: Go LUCI Auto-Submit: Michael Matloob Reviewed-by: Michael Matloob Reviewed-by: Michael Pratt (cherry picked from commit 69338a335ada5882b888fb7eabe0ad6f0e12c986) Reviewed-on: https://go-review.googlesource.com/c/go/+/691958

[release-branch.go1.25] go1.25.0

2025-08-12T20:50:10Z

Change-Id: I46dcb2de47fd752d61863cc351ad792b64995a93 Reviewed-on: https://go-review.googlesource.com/c/go/+/695416 Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov TryBot-Bypass: Gopher Robot Commit-Queue: David Chase Reviewed-by: Dmitri Shuralyov Reviewed-by: David Chase

[release-branch.go1.25] go1.25rc3

2025-08-06T18:09:03Z

Change-Id: I7801c8fe17b0712b479d45fda0d81c060a904097 Reviewed-on: https://go-review.googlesource.com/c/go/+/693716 TryBot-Bypass: Gopher Robot Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov Reviewed-by: Mark Freeman

[release-branch.go1.25] database/sql: avoid closing Rows while scan is in progress

2025-08-06T17:52:26Z

A database/sql/driver.Rows can return database-owned data from Rows.Next. The driver.Rows documentation doesn't explicitly document the lifetime guarantees for this data, but a reasonable expectation is that the caller of Next should only access it until the next call to Rows.Close or Rows.Next. Avoid violating that constraint when a query is cancelled while a call to database/sql.Rows.Scan (note the difference between the two different Rows types!) is in progress. We previously took care to avoid closing a driver.Rows while the user has access to driver-owned memory via a RawData, but we could still close a driver.Rows while a Scan call was in the process of reading previously-returned driver-owned data. Update the fake DB used in database/sql tests to invalidate returned data to help catch other places we might be incorrectly retaining it. Updates #74831 Fixes #74834 Change-Id: Ice45b5fad51b679c38e3e1d21ef39156b56d6037 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2540 Reviewed-by: Roland Shoemaker Reviewed-by: Neal Patel Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2600 Reviewed-on: https://go-review.googlesource.com/c/go/+/693559 Auto-Submit: Dmitri Shuralyov TryBot-Bypass: Dmitri Shuralyov Reviewed-by: Mark Freeman Reviewed-by: Dmitri Shuralyov