go, branch go1.25.7

[release-branch.go1.25] go1.25.7

2026-02-04T15:46:51Z

Change-Id: I27d8fca15f8efc9ae0bfa9ffb23d1f258bd89f2a Reviewed-on: https://go-review.googlesource.com/c/go/+/741962 TryBot-Bypass: Gopher Robot Reviewed-by: Michael Pratt Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov

[release-branch.go1.25] crypto/tls: document resumption behavior across Configs

2026-02-03T19:55:54Z

Updates #77113 Updates #77217 Updates CVE-2025-68121 Change-Id: Ia47904a9ed001275aad0243a6a0ce57e6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/740240 LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker Reviewed-by: Michael Pratt Auto-Submit: Filippo Valsorda (cherry picked from commit 1c9abbdc8e9032cd613bd147c78b166ebacc8a2e) Reviewed-on: https://go-review.googlesource.com/c/go/+/741200 Auto-Submit: Michael Pratt

[release-branch.go1.25] crypto/tls: revalidate whole chain on resumption on Windows and macOS

2026-02-03T19:17:48Z

TestHandshakeChangeRootCAsResumption and TestHandshakeGetConfigForClientDifferentClientCAs changed because previously rootA and rootB shared Subject and SPKI, which made the new full-chain revalidation check succeed, as the same leaf would verify against both roots. Updates #77376 Fixes #77425 Cq-Include-Trybots: luci.golang.try:go1.25-darwin-arm64-longtest Change-Id: I60bed694bdc621c9e83f1bd8a8224c016a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/741361 Auto-Submit: Filippo Valsorda Reviewed-by: Dmitri Shuralyov Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Auto-Submit: Roland Shoemaker (cherry picked from commit b691a2edc7f5863f61a07c4a4f087eef1a15a704) Reviewed-on: https://go-review.googlesource.com/c/go/+/741246 Reviewed-by: Michael Pratt Auto-Submit: Michael Pratt

[release-branch.go1.25] crypto/tls: check verifiedChains roots when resuming sessions

2026-01-28T22:03:29Z

When resuming TLS sessions, on the server and client verify that the chains stored in the session state (verifiedChains) are still acceptable with regards to the Config by checking for the inclusion of the root in either ClientCAs (server) or RootCAs (client). This prevents resuming a session with a certificate chain that would be rejected during a full handshake due to an untrusted root. Updates #77113 Updates #77356 Updates CVE-2025-68121 Change-Id: I11fe00909ef1961c24ecf80bf5b97f7b1121d359 Reviewed-on: https://go-review.googlesource.com/c/go/+/737700 Auto-Submit: Roland Shoemaker Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-by: Coia Prant Reviewed-by: Filippo Valsorda Reviewed-on: https://go-review.googlesource.com/c/go/+/740065 Auto-Submit: Dmitri Shuralyov Reviewed-by: Nicholas Husin Reviewed-by: Damien Neil Reviewed-by: Nicholas Husin

[release-branch.go1.25] crypto/tls: add verifiedChains expiration checking during resumption

2026-01-28T22:03:25Z

When resuming a session, check that the verifiedChains contain at least one chain that is still valid at the time of resumption. If not, trigger a new handshake. Updates #77113 Updates #77356 Updates CVE-2025-68121 Change-Id: I14f585c43da17802513cbdd5b10c552d7a38b34e Reviewed-on: https://go-review.googlesource.com/c/go/+/739321 Reviewed-by: Coia Prant Reviewed-by: Filippo Valsorda Auto-Submit: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-on: https://go-review.googlesource.com/c/go/+/740064 Reviewed-by: Damien Neil Auto-Submit: Dmitri Shuralyov Reviewed-by: Nicholas Husin Reviewed-by: Nicholas Husin

[release-branch.go1.25] Revert "crypto/tls: don't copy auto-rotated session ticket keys in Config.Clone"

2026-01-28T22:03:22Z

This reverts CL 736709 (commit bba24719a4cad5cc8d771fc9cfff5a38019d554a). Updates #77113 Updates #77356 Updates CVE-2025-68121 Change-Id: I0261cb75e9adf9d0ac9890dc91ae8476b8988ba0 Reviewed-on: https://go-review.googlesource.com/c/go/+/739320 Reviewed-by: Coia Prant Reviewed-by: Filippo Valsorda LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-on: https://go-review.googlesource.com/c/go/+/740063 Reviewed-by: Nicholas Husin Reviewed-by: Damien Neil Auto-Submit: Dmitri Shuralyov Reviewed-by: Nicholas Husin

[release-branch.go1.25] crypto/x509: fix single label excluded name constraints handling

2026-01-28T21:39:00Z

Only strip labels when both the domain and constraint have more than one label. Fixes #76935 Fixes #77323 Change-Id: Ifdaae2cbe0c57984bb7334a8f08fa33a800e7c27 Reviewed-on: https://go-review.googlesource.com/c/go/+/739400 Auto-Submit: Dmitri Shuralyov Reviewed-by: Damien Neil Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI

[release-branch.go1.25] cmd/go: remove user-content from doc strings in cgo ASTs.

2026-01-28T20:31:52Z

Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Updates #76697 Fixes #77129 Fixes CVE-2025-61732 Change-Id: I9ecbef556f6e545fb152407041cd086c069f22d1 Reviewed-on: https://go-review.googlesource.com/c/go/+/740040 Auto-Submit: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker

[release-branch.go1.25] cmd/compile: during regalloc, fixedreg values are always available

2026-01-27T16:57:50Z

It is ok to clobber registers that have a copy of a fixedreg value, as that value is always available in its original location later if we need it. (See 14 lines below the change.) This CL will fix the regalloc infinite loop that CL 678620 introduced. That CL requests that the stack pointer value be materialized in a non-stack-pointer register, which is atypical. That condition triggered the infinite loop that this CL fixes. The infinite loop is the compiler trying to reuse that non-stack-pointer register for something else, but then refusing to give it up because it thought that non-stack-pointer register held the last copy of the original SP value. Fixes #75844 Change-Id: Id604d0937fb9d3753ee273bf1917753d3ef2d5d7 Reviewed-on: https://go-review.googlesource.com/c/go/+/696035 Reviewed-by: David Chase Reviewed-by: Keith Randall LUCI-TryBot-Result: Go LUCI (cherry picked from commit 9bbea0f21a4539ea365d4804131b17d3b963c4f7) Reviewed-on: https://go-review.googlesource.com/c/go/+/710875 Reviewed-by: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov

[release-branch.go1.25] go1.25.6

2026-01-15T18:28:34Z

Change-Id: Ib93e4136188fce36867537b30977a03885b8b14f Reviewed-on: https://go-review.googlesource.com/c/go/+/736761 Reviewed-by: Michael Pratt Auto-Submit: Gopher Robot Reviewed-by: Junyang Shao TryBot-Bypass: Gopher Robot