go, branch go1.26.1

[release-branch.go1.26] go1.26.1

2026-03-06T00:26:39Z

Change-Id: Ia2366ca54412a0e31c3838f71f302e2e7f26260e Reviewed-on: https://go-review.googlesource.com/c/go/+/752121 Auto-Submit: Gopher Robot Reviewed-by: Jakub Ciolek TryBot-Bypass: Gopher Robot Reviewed-by: Cherry Mui Reviewed-by: Dmitri Shuralyov

[release-branch.go1.26] crypto/x509: fix name constraint checking panic

2026-03-06T00:12:58Z

Apparently we allow empty dNSName SANs (e.g. a domain name of ""), which causes the excluded domain name wildcard checking to panic, because we assume names are always non-empty. RFC 5280 appears to say the empty string should not be accepted, although confusingly refers to this as " " (a single space). We should probably not allow that when creating certificates, and possibly when creating them as well (1.27 I guess). Thanks to Jakub Ciolek for reporting this issue. Updates #77953 Fixes #77974 Fixes CVE-2026-27138 Change-Id: I4fb213a5450470969a7436cba09b71fd1755a6af Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3420 Reviewed-by: Neal Patel Reviewed-by: Nicholas Husin Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3621 Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/752083 Reviewed-by: Dmitri Shuralyov TryBot-Bypass: Gopher Robot Auto-Submit: Gopher Robot Reviewed-by: Cherry Mui

[release-branch.go1.26] crypto/x509: fix full email constraint matching

2026-03-06T00:12:54Z

For full email addresses (local@domain), we stored a map between the case sensitive local portion to the case insensitive domain portion, and used that to check if a email SAN matched the constraint. This could be abused, because it was a map[string]string, meaning if any two constraints had the same local portion but different domains, the second would overwrite the first. Change the map from map[string]string to map[rfc2821Mailbox]struct{}, where the domain portion of the mailbox is lowercased. When checking for a match we then check the parsed mailbox against the map, lowercasing the domain portion of the query when we initially parse the address. This gives us the same functionality as before, but without the possibility of one constraint overwriting another. Thanks to Jakub Ciolek for reporting this issue. Updates #77952 Fixes #77973 Fixes CVE-2026-27137 Change-Id: Ia405209be6f3b87cf4ac220a645467418dc41805 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3440 Reviewed-by: Neal Patel Reviewed-by: Nicholas Husin Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3620 Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/752082 TryBot-Bypass: Gopher Robot Auto-Submit: Gopher Robot Reviewed-by: Dmitri Shuralyov Reviewed-by: Cherry Mui

[release-branch.go1.26] html/template: properly escape URLs in meta content attributes

2026-03-06T00:12:49Z

The meta tag can include a content attribute that contains URLs, which we currently don't escape if they are inserted via a template action. This can plausibly lead to XSS vulnerabilities if untrusted data is inserted there, the http-equiv attribute is set to "refresh", and the content attribute contains an action like `url={{.}}`. Track whether we are inside of a meta element, if we are inside of a content attribute, _and_ if the content attribute contains "url=". If all of those are true, then we will apply the same URL escaping that we use elsewhere. Also add a new GODEBUG, htmlmetacontenturlescape, to allow disabling this escaping for cases where this behavior is considered safe. The behavior can be disabled by setting htmlmetacontenturlescape=0. Updates #77954 Fixes #77972 Fixes CVE-2026-27142 Change-Id: I9bbca263be9894688e6ef1e9a8f8d2f4304f5873 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3360 Reviewed-by: Neal Patel Reviewed-by: Nicholas Husin Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3643 Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/752081 Auto-Submit: Gopher Robot Reviewed-by: Cherry Mui TryBot-Bypass: Gopher Robot Reviewed-by: Dmitri Shuralyov

[release-branch.go1.26] net/url: reject IPv6 literal not at start of host

2026-03-06T00:12:45Z

This change rejects IPv6 literals that do not appear at the start of the host subcomponent of a URL. For example: http://example.com[::1] -> rejects http://[::1] -> accepts Thanks to Masaki Hara (https://github.com/qnighy) of Wantedly. Updates #77578 Fixes #77970 Fixes CVE-2026-25679 Change-Id: I7109031880758f7c1eb4eca513323328feace33c Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3400 Reviewed-by: Neal Patel Reviewed-by: Roland Shoemaker Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3622 Reviewed-on: https://go-review.googlesource.com/c/go/+/752080 Auto-Submit: Gopher Robot TryBot-Bypass: Gopher Robot Reviewed-by: Dmitri Shuralyov Reviewed-by: Cherry Mui

[release-branch.go1.26] cmd/go: revert update default go directive in mod or work init

2026-03-04T18:38:52Z

This restores the previous behavior of setting go directive to the toolchain's version as per #77653. For #77653 Fixes #77860 Change-Id: Ie9d2de025a75f39fd8d6d01776d0cf4e5da954f9 Reviewed-on: https://go-review.googlesource.com/c/go/+/749948 LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-by: Austin Clements

[release-branch.go1.26] cmd: re-vendor x/tools for Go 1.26.1

2026-03-03T02:06:21Z

Update x/tools vendor to the tip of internal-branch.go1.26-vendor branch (642dd50), to pull in recent fixes of the modernizer. Done by cd GOROOT/cmd go get golang.org/x/tools@internal-branch.go1.26-vendor go mod tidy go mod vendor Fixes #77766 Fixes #77803 Fixes #77804 Fixes #77805 Fixes #77807 Fixes #77849 Fixes #77899 Fixes #77904 Change-Id: Id7aa8c2247949bdc104898270a4ceb3eee68a818 Reviewed-on: https://go-review.googlesource.com/c/go/+/750761 LUCI-TryBot-Result: Go LUCI Reviewed-by: Alan Donovan

[release-branch.go1.26] os: avoid escape from Root via ReadDir or Readdir

2026-02-27T21:48:25Z

When reading the contents of a directory using File.ReadDir or File.Readdir, the os.FileInfo was populated on Unix platforms using lstat. This lstat call is vulnerable to a TOCTOU race and could escape the root. For example: - Open the directory "dir" within a Root. This directory contains a file named "file". - Use File.ReadDir to list the contents of "dir", receiving a os.DirEntry for "dir/file". - Replace "dir" with a symlink to "/etc". - Use DirEntry.Info to retrieve the FileInfo for "dir/file". This FileInfo contains information on "/etc/file" instead. This escape permits identifying the presence or absence of files outside a Root, as well as retreiving stat metadata (size, mode, modification time, etc.) for files outside a Root. This escape does not permit reading or writing to files outside a Root. For #77827 Fixes #77834 Fixes CVE-2026-27139 Change-Id: I40004f830c588e516aff8ee593d630d36a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/749480 LUCI-TryBot-Result: Go LUCI Reviewed-by: Nicholas Husin Reviewed-by: Nicholas Husin Auto-Submit: Damien Neil (cherry picked from commit 657ed934e85dc575aad51356c4b437961e7c1313) Reviewed-on: https://go-review.googlesource.com/c/go/+/749822

[release-branch.go1.26] cmd/compile: ensure StructMake/ArrayMake1 of direct interfaces are unwrapped

2026-02-26T19:45:11Z

Ensures that deeply nested structs that have the underlying shape of a pointer get unwrapped properly. Update #77536 Change-Id: I004f424d2c62ec7026281daded9b3d96c021e2e1 Reviewed-on: https://go-review.googlesource.com/c/go/+/747760 Reviewed-by: Mark Freeman LUCI-TryBot-Result: Go LUCI Reviewed-by: David Chase (cherry picked from commit 1aa534dbb8970b86b0f4059b7665e3505d145e25) Reviewed-on: https://go-review.googlesource.com/c/go/+/749460

[release-branch.go1.26] cmd/compile: pointer-shaped types are SSAable even if lots of 0-sized fields

2026-02-26T18:36:00Z

Normally we don't SSA-ify variables with types that have more than 4 fields. But we really do want to SSA-ify them if they are pointer shaped. An odd case, but the compiler shouldn't barf on them. Failure probably started with CL 714421. Fixes #77536 Change-Id: I51ef87676cc31df1e51e164bbd58d58c0ab72436 Reviewed-on: https://go-review.googlesource.com/c/go/+/744280 Reviewed-by: Junyang Shao LUCI-TryBot-Result: Go LUCI Reviewed-by: David Chase (cherry picked from commit 6435bf46c17dccb2eb5f7bab7dd8aa4972252b21) Reviewed-on: https://go-review.googlesource.com/c/go/+/749421 Reviewed-by: Mark Freeman