go, branch go1.26rc3

[release-branch.go1.26] go1.26rc3

2026-02-04T15:46:44Z

Change-Id: Icdbfe2e74b099da6f3498549873c18e1ef295c64 Reviewed-on: https://go-review.googlesource.com/c/go/+/741942 Auto-Submit: Gopher Robot Reviewed-by: Michael Pratt Reviewed-by: Dmitri Shuralyov TryBot-Bypass: Gopher Robot

[release-branch.go1.26] crypto/tls: document resumption behavior across Configs

2026-02-03T19:26:48Z

Updates #77113 Updates #77217 Updates CVE-2025-68121 Change-Id: Ia47904a9ed001275aad0243a6a0ce57e6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/740240 LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker Reviewed-by: Michael Pratt Auto-Submit: Filippo Valsorda (cherry picked from commit 1c9abbdc8e9032cd613bd147c78b166ebacc8a2e) Reviewed-on: https://go-review.googlesource.com/c/go/+/741181 Auto-Submit: Michael Pratt

[release-branch.go1.26] crypto/tls: revalidate whole chain on resumption on Windows and macOS

2026-02-03T19:17:52Z

TestHandshakeChangeRootCAsResumption and TestHandshakeGetConfigForClientDifferentClientCAs changed because previously rootA and rootB shared Subject and SPKI, which made the new full-chain revalidation check succeed, as the same leaf would verify against both roots. Updates #77376 Fixes #77426 Cq-Include-Trybots: luci.golang.try:go1.26-darwin-arm64-longtest Change-Id: I60bed694bdc621c9e83f1bd8a8224c016a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/741361 Auto-Submit: Filippo Valsorda Reviewed-by: Dmitri Shuralyov Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Auto-Submit: Roland Shoemaker (cherry picked from commit b691a2edc7f5863f61a07c4a4f087eef1a15a704) Reviewed-on: https://go-review.googlesource.com/c/go/+/741680 Reviewed-by: Michael Pratt Auto-Submit: Michael Pratt

[release-branch.go1.26] internal/poll: readWriteUnlock should destroy fd when no remaining references

2026-02-03T15:55:04Z

Updates #77404 Fixes #77405 Change-Id: I0402becb94855baf942d6ba3815cc2a3c1526d6e Reviewed-on: https://go-review.googlesource.com/c/go/+/740921 LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-by: Michael Pratt (cherry picked from commit 31c9bcb1037a332fd547808693cd1899090b5854) Reviewed-on: https://go-review.googlesource.com/c/go/+/741360 Auto-Submit: Michael Pratt

[release-branch.go1.26] cmd/compile/internal/bloop: avoid extraneous heap allocs in b.Loop body due to autotmp variable scope

2026-01-30T17:55:08Z

The motivating example I created for #73137 still seems to heap allocate in go1.26rc2 when used in a b.Loop body. │ go1.25 │ go1.26rc2 │ │ allocs/op │ allocs/op vs base │ NewX/b.Loop-basic-4 1.000 ± 0% 1.000 ± 0% ~ (p=1.000 n=10) ¹ I suspect it is because the temps are by default declared outside the loop body, which escape analysis will determine is an escaping value and result in a heap allocation. (I've seen this problem before, including in my older CL 546023 that attempts to help PGO with a similar issue.) This is an attempt to address that by placing ODCLs within the b.Loop body for the temps that are created so that they can be marked keepalive. There are two cases handled in the CL: function return values and function arguments. The first case is what affects my example from #73137, and is also illustrated via the NewX test case in the new test/escape_bloop.go file. Without this CL, the NewX call in the BenchmarkBloop test is inlined, which is an improvement over Go 1.25, but the slice still escapes because the temporary used for the return value is declared outside the loop body. With this CL, the slice does not escape. The second case is illustrated via the new BenchmarkBLoopFunctionArg test, which shows a function argument that escapes without this CL but does not escape with this CL. We can also make the two new b.Loop tests in testing/benchmark_test.go individually pass or fail as expected based on individually reverting the two changes in this CL. While we are here, we add a note to typecheck.TempAt to help make people aware of this behavior. Updates #73137 Fixes #77339 Reviewed-on: https://go-review.googlesource.com/c/go/+/738822 LUCI-TryBot-Result: Go LUCI Reviewed-by: Cherry Mui Reviewed-by: Junyang Shao Change-Id: I80e89ca95ba297b0d95f02782e6f4ae901a4361a Reviewed-on: https://go-review.googlesource.com/c/go/+/740600 Reviewed-by: Austin Clements Auto-Submit: Junyang Shao Reviewed-by: Dmitri Shuralyov

[release-branch.go1.26] simd/archsimd: add missing cpufeature to generated mask/merge methods

2026-01-29T16:15:43Z

Change-Id: I34678f4ef17fe1b8b7657a2c3d39685b4a5951f2 Reviewed-on: https://go-review.googlesource.com/c/go/+/739981 LUCI-TryBot-Result: Go LUCI Reviewed-by: Cherry Mui (cherry picked from commit 985b0b3fe26661c10a3201470e80685765656363) Reviewed-on: https://go-review.googlesource.com/c/go/+/739941 Reviewed-by: David Chase

[release-branch.go1.26] crypto/tls: check verifiedChains roots when resuming sessions

2026-01-28T22:00:47Z

When resuming TLS sessions, on the server and client verify that the chains stored in the session state (verifiedChains) are still acceptable with regards to the Config by checking for the inclusion of the root in either ClientCAs (server) or RootCAs (client). This prevents resuming a session with a certificate chain that would be rejected during a full handshake due to an untrusted root. Updates #77113 Updates #77357 Updates CVE-2025-68121 Change-Id: I11fe00909ef1961c24ecf80bf5b97f7b1121d359 Reviewed-on: https://go-review.googlesource.com/c/go/+/737700 Auto-Submit: Roland Shoemaker Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-by: Coia Prant Reviewed-by: Filippo Valsorda Reviewed-on: https://go-review.googlesource.com/c/go/+/740004 Reviewed-by: Damien Neil Reviewed-by: Nicholas Husin Auto-Submit: Dmitri Shuralyov Reviewed-by: Nicholas Husin

[release-branch.go1.26] crypto/tls: add verifiedChains expiration checking during resumption

2026-01-28T22:00:44Z

When resuming a session, check that the verifiedChains contain at least one chain that is still valid at the time of resumption. If not, trigger a new handshake. Updates #77113 Updates #77357 Updates CVE-2025-68121 Change-Id: I14f585c43da17802513cbdd5b10c552d7a38b34e Reviewed-on: https://go-review.googlesource.com/c/go/+/739321 Reviewed-by: Coia Prant Reviewed-by: Filippo Valsorda Auto-Submit: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-on: https://go-review.googlesource.com/c/go/+/740003 Reviewed-by: Nicholas Husin Reviewed-by: Damien Neil Auto-Submit: Dmitri Shuralyov Reviewed-by: Nicholas Husin

[release-branch.go1.26] Revert "crypto/tls: don't copy auto-rotated session ticket keys in Config.Clone"

2026-01-28T22:00:41Z

This reverts CL 736709 (commit bba24719a4cad5cc8d771fc9cfff5a38019d554a). Updates #77113 Updates #77357 Updates CVE-2025-68121 Change-Id: I0261cb75e9adf9d0ac9890dc91ae8476b8988ba0 Reviewed-on: https://go-review.googlesource.com/c/go/+/739320 Reviewed-by: Coia Prant Reviewed-by: Filippo Valsorda LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-on: https://go-review.googlesource.com/c/go/+/740002 Reviewed-by: Damien Neil Reviewed-by: Nicholas Husin Auto-Submit: Dmitri Shuralyov Reviewed-by: Nicholas Husin

[release-branch.go1.26] cmd/compile, simd: capture VAES instructions and fix AVX512VAES feature

2026-01-28T19:57:53Z

The code previously filters out VAES-only instructions, this CL added them back. This CL added the VAES feature check following the Intel xed data: XED_ISA_SET_VAES: vaes.7.0.ecx.9 # avx.1.0.ecx.28 This CL also found out that the old AVX512VAES feature check is not checking the correct bits, it also fixes it: XED_ISA_SET_AVX512_VAES_128: vaes.7.0.ecx.9 aes.1.0.ecx.25 avx512f.7.0.ebx.16 avx512vl.7.0.ebx.31 XED_ISA_SET_AVX512_VAES_256: vaes.7.0.ecx.9 aes.1.0.ecx.25 avx512f.7.0.ebx.16 avx512vl.7.0.ebx.31 XED_ISA_SET_AVX512_VAES_512: vaes.7.0.ecx.9 aes.1.0.ecx.25 avx512f.7.0.ebx.16 It restricts to the most strict common set - includes avx512vl for even 512-bits although it doesn't requires it. Change-Id: I4e2f72b312fd2411589fbc12f9ee5c63c09c2e9a Reviewed-on: https://go-review.googlesource.com/c/go/+/738500 Reviewed-by: Cherry Mui LUCI-TryBot-Result: Go LUCI (cherry picked from commit 83b232b0af1bd498d3df099eb68e3b1e40df2527) Reviewed-on: https://go-review.googlesource.com/c/go/+/739922 Reviewed-by: Junyang Shao