aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-02-04[release-branch.go1.26] go1.26rc3go1.26rc3Gopher Robot
Change-Id: Icdbfe2e74b099da6f3498549873c18e1ef295c64 Reviewed-on: https://go-review.googlesource.com/c/go/+/741942 Auto-Submit: Gopher Robot <gobot@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Bypass: Gopher Robot <gobot@golang.org>
2026-02-03[release-branch.go1.26] crypto/tls: document resumption behavior across ConfigsFilippo Valsorda
Updates #77113 Updates #77217 Updates CVE-2025-68121 Change-Id: Ia47904a9ed001275aad0243a6a0ce57e6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/740240 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> (cherry picked from commit 1c9abbdc8e9032cd613bd147c78b166ebacc8a2e) Reviewed-on: https://go-review.googlesource.com/c/go/+/741181 Auto-Submit: Michael Pratt <mpratt@google.com>
2026-02-03[release-branch.go1.26] crypto/tls: revalidate whole chain on resumption on ↵Filippo Valsorda
Windows and macOS TestHandshakeChangeRootCAsResumption and TestHandshakeGetConfigForClientDifferentClientCAs changed because previously rootA and rootB shared Subject and SPKI, which made the new full-chain revalidation check succeed, as the same leaf would verify against both roots. Updates #77376 Fixes #77426 Cq-Include-Trybots: luci.golang.try:go1.26-darwin-arm64-longtest Change-Id: I60bed694bdc621c9e83f1bd8a8224c016a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/741361 Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org> (cherry picked from commit b691a2edc7f5863f61a07c4a4f087eef1a15a704) Reviewed-on: https://go-review.googlesource.com/c/go/+/741680 Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Michael Pratt <mpratt@google.com>
2026-02-03[release-branch.go1.26] internal/poll: readWriteUnlock should destroy fd ↵qmuntal
when no remaining references Updates #77404 Fixes #77405 Change-Id: I0402becb94855baf942d6ba3815cc2a3c1526d6e Reviewed-on: https://go-review.googlesource.com/c/go/+/740921 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> (cherry picked from commit 31c9bcb1037a332fd547808693cd1899090b5854) Reviewed-on: https://go-review.googlesource.com/c/go/+/741360 Auto-Submit: Michael Pratt <mpratt@google.com>
2026-01-30[release-branch.go1.26] cmd/compile/internal/bloop: avoid extraneous heap ↵thepudds
allocs in b.Loop body due to autotmp variable scope The motivating example I created for #73137 still seems to heap allocate in go1.26rc2 when used in a b.Loop body. │ go1.25 │ go1.26rc2 │ │ allocs/op │ allocs/op vs base │ NewX/b.Loop-basic-4 1.000 ± 0% 1.000 ± 0% ~ (p=1.000 n=10) ¹ I suspect it is because the temps are by default declared outside the loop body, which escape analysis will determine is an escaping value and result in a heap allocation. (I've seen this problem before, including in my older CL 546023 that attempts to help PGO with a similar issue.) This is an attempt to address that by placing ODCLs within the b.Loop body for the temps that are created so that they can be marked keepalive. There are two cases handled in the CL: function return values and function arguments. The first case is what affects my example from #73137, and is also illustrated via the NewX test case in the new test/escape_bloop.go file. Without this CL, the NewX call in the BenchmarkBloop test is inlined, which is an improvement over Go 1.25, but the slice still escapes because the temporary used for the return value is declared outside the loop body. With this CL, the slice does not escape. The second case is illustrated via the new BenchmarkBLoopFunctionArg test, which shows a function argument that escapes without this CL but does not escape with this CL. We can also make the two new b.Loop tests in testing/benchmark_test.go individually pass or fail as expected based on individually reverting the two changes in this CL. While we are here, we add a note to typecheck.TempAt to help make people aware of this behavior. Updates #73137 Fixes #77339 Reviewed-on: https://go-review.googlesource.com/c/go/+/738822 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Change-Id: I80e89ca95ba297b0d95f02782e6f4ae901a4361a Reviewed-on: https://go-review.googlesource.com/c/go/+/740600 Reviewed-by: Austin Clements <austin@google.com> Auto-Submit: Junyang Shao <shaojunyang@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2026-01-29[release-branch.go1.26] simd/archsimd: add missing cpufeature to generated ↵David Chase
mask/merge methods Change-Id: I34678f4ef17fe1b8b7657a2c3d39685b4a5951f2 Reviewed-on: https://go-review.googlesource.com/c/go/+/739981 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com> (cherry picked from commit 985b0b3fe26661c10a3201470e80685765656363) Reviewed-on: https://go-review.googlesource.com/c/go/+/739941 Reviewed-by: David Chase <drchase@google.com>
2026-01-28[release-branch.go1.26] crypto/tls: check verifiedChains roots when resuming ↵Roland Shoemaker
sessions When resuming TLS sessions, on the server and client verify that the chains stored in the session state (verifiedChains) are still acceptable with regards to the Config by checking for the inclusion of the root in either ClientCAs (server) or RootCAs (client). This prevents resuming a session with a certificate chain that would be rejected during a full handshake due to an untrusted root. Updates #77113 Updates #77357 Updates CVE-2025-68121 Change-Id: I11fe00909ef1961c24ecf80bf5b97f7b1121d359 Reviewed-on: https://go-review.googlesource.com/c/go/+/737700 Auto-Submit: Roland Shoemaker <roland@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Coia Prant <coiaprant@gmail.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-on: https://go-review.googlesource.com/c/go/+/740004 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2026-01-28[release-branch.go1.26] crypto/tls: add verifiedChains expiration checking ↵Roland Shoemaker
during resumption When resuming a session, check that the verifiedChains contain at least one chain that is still valid at the time of resumption. If not, trigger a new handshake. Updates #77113 Updates #77357 Updates CVE-2025-68121 Change-Id: I14f585c43da17802513cbdd5b10c552d7a38b34e Reviewed-on: https://go-review.googlesource.com/c/go/+/739321 Reviewed-by: Coia Prant <coiaprant@gmail.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/740003 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2026-01-28[release-branch.go1.26] Revert "crypto/tls: don't copy auto-rotated session ↵Roland Shoemaker
ticket keys in Config.Clone" This reverts CL 736709 (commit bba24719a4cad5cc8d771fc9cfff5a38019d554a). Updates #77113 Updates #77357 Updates CVE-2025-68121 Change-Id: I0261cb75e9adf9d0ac9890dc91ae8476b8988ba0 Reviewed-on: https://go-review.googlesource.com/c/go/+/739320 Reviewed-by: Coia Prant <coiaprant@gmail.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/740002 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2026-01-28[release-branch.go1.26] cmd/compile, simd: capture VAES instructions and fix ↵Junyang Shao
AVX512VAES feature The code previously filters out VAES-only instructions, this CL added them back. This CL added the VAES feature check following the Intel xed data: XED_ISA_SET_VAES: vaes.7.0.ecx.9 # avx.1.0.ecx.28 This CL also found out that the old AVX512VAES feature check is not checking the correct bits, it also fixes it: XED_ISA_SET_AVX512_VAES_128: vaes.7.0.ecx.9 aes.1.0.ecx.25 avx512f.7.0.ebx.16 avx512vl.7.0.ebx.31 XED_ISA_SET_AVX512_VAES_256: vaes.7.0.ecx.9 aes.1.0.ecx.25 avx512f.7.0.ebx.16 avx512vl.7.0.ebx.31 XED_ISA_SET_AVX512_VAES_512: vaes.7.0.ecx.9 aes.1.0.ecx.25 avx512f.7.0.ebx.16 It restricts to the most strict common set - includes avx512vl for even 512-bits although it doesn't requires it. Change-Id: I4e2f72b312fd2411589fbc12f9ee5c63c09c2e9a Reviewed-on: https://go-review.googlesource.com/c/go/+/738500 Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> (cherry picked from commit 83b232b0af1bd498d3df099eb68e3b1e40df2527) Reviewed-on: https://go-review.googlesource.com/c/go/+/739922 Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-23[release-branch.go1.26] internal/buildcfg: disable sizespecializedmalloc by ↵Michael Anthony Knyszek
default We're finding some regressions in overall icache footprint at scale and we should figure out how to deal with those before rolling this out to everybody. Change-Id: I98e792db31712bf64575d76dfeafedb48898f76a Reviewed-on: https://go-review.googlesource.com/c/go/+/738780 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Michael Knyszek <mknyszek@google.com> (cherry picked from commit 4af8ad24ee3b55ccb644680d95e2502e5551ea0b) Reviewed-on: https://go-review.googlesource.com/c/go/+/738900
2026-01-21[release-branch.go1.26] all: merge master (2baa1d1) into release-branch.go1.26Carlos Amedee
For #76474. Change-Id: Ic50e288f99b731b62af9aa73ce6721f0f2f3596d
2026-01-21runtime: remove the unused scanIdx from mspanYoulin Feng
After CL 700496, mspan.scanIdx is never used, this CL just remove it. Change-Id: I41ce9902957c0cfa6fbf26b66a2a7787b179376a Reviewed-on: https://go-review.googlesource.com/c/go/+/737220 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Carlos Amedee <carlos@golang.org> Auto-Submit: Carlos Amedee <carlos@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2026-01-20cmd/compile/internal/staticinit: fix bug in global new(expr)Alan Donovan
The StaticInit pass asserts that the operand of &v is a global, but this is not so for the &autotemp desugaring of new(expr). (The variable has by that point escaped to the heap, so the object code calls runtime.newobject. A future optimization would be to statically allocate the variable when it is safe and advantageous to do so.) Thanks to khr for suggesting the fix. + static test Fixes #77237 Change-Id: I71b34a1353fe0f3e297beab9851f8f87d765d8f1 Reviewed-on: https://go-review.googlesource.com/c/go/+/737680 Reviewed-by: Keith Randall <khr@golang.org> Reviewed-by: Keith Randall <khr@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-20strconv: don't call internal Atoi twice in AtoiDaniel Müllner
Change-Id: I89a41bbc83fdf473399527a933d57794ce83f68a Reviewed-on: https://go-review.googlesource.com/c/go/+/737261 Reviewed-by: Russ Cox <rsc@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Florian Lehner <lehner.florian86@gmail.com>
2026-01-16doc: fix urlmaxqueryparams typosMichael Pratt
Updates #77101. Change-Id: I6a6a636cd58e1bd01943066368cb1424db6c6a92 Reviewed-on: https://go-review.googlesource.com/c/go/+/737040 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-15go/types,cmd/compile/internal/types2: better diagnostic for type shadowingAlan Donovan
This change causes the "x is not a type" diagnostic to describe x's actual kind, helping to reveal when shadowing is at work. (The kind description could improve other errors too.) Fixes #76877 Change-Id: Ia3484998bb384ff570c20b6792cf8461c60aa38c Reviewed-on: https://go-review.googlesource.com/c/go/+/731180 Reviewed-by: Robert Griesemer <gri@google.com> Auto-Submit: Alan Donovan <adonovan@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Robert Griesemer <gri@google.com>
2026-01-15archive/zip: reduce CPU usage in index constructionDamien Neil
Constructing the zip index (which is done once when first opening a file in an archive) can consume large amounts of CPU when processing deeply-nested directory paths. Switch to a less inefficient algorithm. Thanks to Jakub Ciolek for reporting this issue. goos: darwin goarch: arm64 pkg: archive/zip cpu: Apple M4 Pro │ /tmp/bench.0 │ /tmp/bench.1 │ │ sec/op │ sec/op vs base │ ReaderOneDeepDir-14 25983.62m ± 2% 46.01m ± 2% -99.82% (p=0.000 n=8) ReaderManyDeepDirs-14 16.221 ± 1% 2.763 ± 6% -82.96% (p=0.000 n=8) ReaderManyShallowFiles-14 130.3m ± 1% 128.8m ± 2% -1.20% (p=0.003 n=8) geomean 3.801 253.9m -93.32% Fixes #77102 Fixes CVE-2025-61728 Change-Id: I2c9c864be01b2a2769eb67fbab1b250aeb8f6c42 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3060 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736713 Auto-Submit: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-15net/url: add urlmaxqueryparams GODEBUG to limit the number of query parametersDamien Neil
net/url does not currently limit the number of query parameters parsed by url.ParseQuery or URL.Query. When parsing a application/x-www-form-urlencoded form, net/http.Request.ParseForm will parse up to 10 MB of query parameters. An input consisting of a large number of small, unique parameters can cause excessive memory consumption. We now limit the number of query parameters parsed to 10000 by default. The limit can be adjusted by setting GODEBUG=urlmaxqueryparams=<n>. Setting urlmaxqueryparams to 0 disables the limit. Thanks to jub0bs for reporting this issue. Fixes #77101 Fixes CVE-2025-61726 Change-Id: Iee3374c7ee2d8586dbf158536d3ade424203ff66 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3020 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736712 Auto-Submit: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-15cmd/go/internal/work: sanitize flags before invoking 'pkg-config'Neal Patel
The addition of CgoPkgConfig allowed execution with flags not matching the safelist. In order to prevent potential arbitrary code execution at build time, ensure that flags are validated prior to invoking the 'pkg-config' binary. Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Fixes CVE-2025-61731 Fixes #77100 Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3240 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736711 Reviewed-by: Junyang Shao <shaojunyang@google.com> Auto-Submit: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-15cmd/go: update VCS commands to use safer flag/argument syntaxRoland Shoemaker
In various situations, the toolchain invokes VCS commands. Some of these commands take arbitrary input, either provided by users or fetched from external sources. To prevent potential command injection vulnerabilities or misinterpretation of arguments as flags, this change updates the VCS commands to use various techniques to separate flags from positional arguments, and to directly associate flags with their values. Additionally, we update the environment variable for Mercurial to use `HGPLAIN=+strictflags`, which is the more explicit way to disable user configurations (intended or otherwise) that might interfere with command execution. We also now disallow version strings from being prefixed with '-' or '/', as doing so opens us up to making the same mistake again in the future. As far as we know there are currently ~0 public modules affected by this. While I was working on cmd/go/internal/vcs, I also noticed that a significant portion of the commands being implemented were dead code. In order to reduce the maintenance burden and surface area for potential issues, I removed the dead code for unused commands. We should probably follow up with a more structured change to make it harder to accidentally re-introduce these issues in the future, but for now this addresses the issue at hand. Thanks to splitline (@splitline) from DEVCORE Research Team for reporting this issue. Fixes CVE-2025-68119 Fixes #77099 Change-Id: I9d9f4ee05b95be49fe14edf71a1b8e6c0784378e Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3260 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736710 Auto-Submit: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-15crypto/tls: don't copy auto-rotated session ticket keys in Config.CloneRoland Shoemaker
Once a tls.Config is used, it is not safe to mutate. We provide the Clone method in order to allow users to copy and modify a Config that is in use. If Config.SessionTicketKey is not populated, and if Config.SetSessionTicketKeys has not been called, we automatically populate and rotate session ticket keys. Clone was previously copying these keys into the new Config, meaning that two Configs could share the same auto-rotated session ticket keys. This could allow sessions to be resumed across different Configs, which may have completely different configurations. This change updates Clone to not copy the auto-rotated session ticket keys. Additionally, when resuming a session, check that not just that the leaf certificate is unexpired, but that the entire certificate chain is still unexpired. Fixes #77113 Fixes CVE-2025-68121 Change-Id: I011df7329de83068d11b3f0c793763692d018a98 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3300 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736709 Auto-Submit: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-15[release-branch.go1.26] go1.26rc2go1.26rc2Gopher Robot
Change-Id: If5ce85a68010848f16c4c2509e18466ed1356912 Reviewed-on: https://go-review.googlesource.com/c/go/+/736763 TryBot-Bypass: Gopher Robot <gobot@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Auto-Submit: Gopher Robot <gobot@golang.org>
2026-01-15[release-branch.go1.26] archive/zip: reduce CPU usage in index constructionDamien Neil
Constructing the zip index (which is done once when first opening a file in an archive) can consume large amounts of CPU when processing deeply-nested directory paths. Switch to a less inefficient algorithm. Thanks to Jakub Ciolek for reporting this issue. goos: darwin goarch: arm64 pkg: archive/zip cpu: Apple M4 Pro │ /tmp/bench.0 │ /tmp/bench.1 │ │ sec/op │ sec/op vs base │ ReaderOneDeepDir-14 25983.62m ± 2% 46.01m ± 2% -99.82% (p=0.000 n=8) ReaderManyDeepDirs-14 16.221 ± 1% 2.763 ± 6% -82.96% (p=0.000 n=8) ReaderManyShallowFiles-14 130.3m ± 1% 128.8m ± 2% -1.20% (p=0.003 n=8) geomean 3.801 253.9m -93.32% Fixes #77102 Fixes CVE-2025-61728 Change-Id: I2c9c864be01b2a2769eb67fbab1b250aeb8f6c42 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3060 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3346 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736708 Auto-Submit: Michael Pratt <mpratt@google.com> TryBot-Bypass: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-15[release-branch.go1.26] net/url: add urlmaxqueryparams GODEBUG to limit the ↵Damien Neil
number of query parameters net/url does not currently limit the number of query parameters parsed by url.ParseQuery or URL.Query. When parsing a application/x-www-form-urlencoded form, net/http.Request.ParseForm will parse up to 10 MB of query parameters. An input consisting of a large number of small, unique parameters can cause excessive memory consumption. We now limit the number of query parameters parsed to 10000 by default. The limit can be adjusted by setting GODEBUG=urlmaxqueryparams=<n>. Setting urlmaxqueryparams to 0 disables the limit. Thanks to jub0bs for reporting this issue. Fixes #77101 Fixes CVE-2025-61726 Change-Id: Iee3374c7ee2d8586dbf158536d3ade424203ff66 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3020 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3345 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736707 Auto-Submit: Michael Pratt <mpratt@google.com> TryBot-Bypass: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-15[release-branch.go1.26] cmd/go/internal/work: sanitize flags before invoking ↵Neal Patel
'pkg-config' The addition of CgoPkgConfig allowed execution with flags not matching the safelist. In order to prevent potential arbitrary code execution at build time, ensure that flags are validated prior to invoking the 'pkg-config' binary. Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Fixes CVE-2025-61731 Fixes #77100 Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3240 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3324 Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736706 Auto-Submit: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> TryBot-Bypass: Michael Pratt <mpratt@google.com>
2026-01-15[release-branch.go1.26] cmd/go: update VCS commands to use safer ↵Roland Shoemaker
flag/argument syntax In various situations, the toolchain invokes VCS commands. Some of these commands take arbitrary input, either provided by users or fetched from external sources. To prevent potential command injection vulnerabilities or misinterpretation of arguments as flags, this change updates the VCS commands to use various techniques to separate flags from positional arguments, and to directly associate flags with their values. Additionally, we update the environment variable for Mercurial to use `HGPLAIN=+strictflags`, which is the more explicit way to disable user configurations (intended or otherwise) that might interfere with command execution. We also now disallow version strings from being prefixed with '-' or '/', as doing so opens us up to making the same mistake again in the future. As far as we know there are currently ~0 public modules affected by this. While I was working on cmd/go/internal/vcs, I also noticed that a significant portion of the commands being implemented were dead code. In order to reduce the maintenance burden and surface area for potential issues, I removed the dead code for unused commands. We should probably follow up with a more structured change to make it harder to accidentally re-introduce these issues in the future, but for now this addresses the issue at hand. Thanks to splitline (@splitline) from DEVCORE Research Team for reporting this issue. Fixes CVE-2025-68119 Fixes #77099 Change-Id: I9d9f4ee05b95be49fe14edf71a1b8e6c0784378e Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3260 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3341 Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736705 Auto-Submit: Michael Pratt <mpratt@google.com> TryBot-Bypass: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-15[release-branch.go1.26] crypto/tls: don't copy auto-rotated session ticket ↵Roland Shoemaker
keys in Config.Clone Once a tls.Config is used, it is not safe to mutate. We provide the Clone method in order to allow users to copy and modify a Config that is in use. If Config.SessionTicketKey is not populated, and if Config.SetSessionTicketKeys has not been called, we automatically populate and rotate session ticket keys. Clone was previously copying these keys into the new Config, meaning that two Configs could share the same auto-rotated session ticket keys. This could allow sessions to be resumed across different Configs, which may have completely different configurations. This change updates Clone to not copy the auto-rotated session ticket keys. Additionally, when resuming a session, check that not just that the leaf certificate is unexpired, but that the entire certificate chain is still unexpired. Fixes #77113 Fixes CVE-2025-68121 Change-Id: I011df7329de83068d11b3f0c793763692d018a98 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3300 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3340 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736704 TryBot-Bypass: Michael Pratt <mpratt@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Auto-Submit: Michael Pratt <mpratt@google.com>
2026-01-15sort: improve comment readability for Stable functionPrateik Lohani
Change-Id: I3bc9f906f85e2b5f3d4ba6484e3c125065e36b57 GitHub-Last-Rev: 5d637c132533691d5a56fd00845bdb1d349642a3 GitHub-Pull-Request: golang/go#77190 Reviewed-on: https://go-review.googlesource.com/c/go/+/736501 Reviewed-by: Robert Griesemer <gri@google.com> Auto-Submit: Keith Randall <khr@golang.org> Auto-Submit: Robert Griesemer <gri@google.com> Reviewed-by: Keith Randall <khr@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Keith Randall <khr@golang.org>
2026-01-14crypto/internal/fips140test: add ML-DSA to FIPS 140-3 functional testsFilippo Valsorda
Change-Id: I568d28d27d2bc55bbadcc678a2fcf9d36a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/731540 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Junyang Shao <shaojunyang@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-13simd/archsimd: 128- and 256-bit FMA operations do not require AVX-512Austin Clements
Currently, all FMA operations are marked as requiring AVX512, even on smaller vector widths. This is happening because the narrower FMA operations are marked as extension "FMA" in the XED. Since this extension doesn't start with "AVX", we filter them out very early in the XED process. However, this is just a quirk of naming: the FMA feature depends on the AVX feature, so it is part of AVX, even if it doesn't say so on the tin. Fix this by accepting the FMA extension and adding FMA to the table of CPU features. We also tweak internal/cpu slightly do it correctly enforces that the logical FMA feature depends on both the FMA and AVX CPUID flags. This actually *deletes* a lot of generated code because we no longer need the AVX-512 encoding of these 128- and 256-bit operations. Change-Id: I744a18d0be888f536ac034fe88b110347622be7e Reviewed-on: https://go-review.googlesource.com/c/go/+/736160 Auto-Submit: Austin Clements <austin@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736201 Reviewed-by: Austin Clements <austin@google.com>
2026-01-13simd/archsimd/_gen/simdgen: feature implicationsAustin Clements
This simplifies our handling of XED features, adds a table of which features imply which other features, and adds this information to the documentation of the CPU features APIs. As part of this we fix an issue around the "AVXAES" feature. AVXAES is defined as the combination of the AVX and AES CPUID flags. Several other features also work like this, but have hand-written logic in internal/cpu to compute logical feature flags from the underlying CPUID bits. For these, we expose a single feature check function from the SIMD API. AVXAES currently doesn't work like this: it requires the user to check both features. However, this forces the SIMD API to expose an "AES" feature check, which really has nothing to do with SIMD. To make this consistent, we introduce an AVXAES feature check function and use it in feature requirement docs. Unlike the others combo features, this is implemented in the simd package, but the difference is invisible to the user. Change-Id: I2985ebd361f0ecd45fd428903efe4c981a5ec65d Reviewed-on: https://go-review.googlesource.com/c/go/+/736100 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/736200 Reviewed-by: Austin Clements <austin@google.com>
2026-01-13runtime: rename mallocTiny* to mallocgcTinySize*Michael Matloob
This makes it easier to identify which functions are used for memory allocation by looking for functions that start with mallocgc. The Size suffix is added so that the isSpecializedMalloc function in cmd/compile/internal/ssa can distinguish between the generated functions and the mallocgcTiny function called by mallocgc, similar to the SC suffixes for the mallocgcSmallNoScanSC* and mallocgcSmallScanNoHeaderSC* functons. Change-Id: I6ad7f15617bf6f18ae5d1bfa2a0b94e86a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/735780 Reviewed-by: Michael Matloob <matloob@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-13all: fix misspellings in commentscuishuang
Change-Id: I121847e7f68c602dd8e9ecddfc41b547f8a86f10 Reviewed-on: https://go-review.googlesource.com/c/go/+/734361 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Robert Griesemer <gri@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-12os/exec: move platform-specific LookPath docs to a common commentDamien Neil
We have four different LookPath variations (unix, windows, plan9, wasm), each with slightly different doc comments. Unify the documentation and move it to a single, common LookPath. Change-Id: I56bae57e80887a73ef0f6933258ee0a48dbccdcf Reviewed-on: https://go-review.googlesource.com/c/go/+/734320 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-12os/exec_test: fix test on Plan 9Ori Bernstein
Error strings vary across OSes when trying to execute a file that does not exist. Since matching them is not the point of the test, ignore them. Fixes #76965 Change-Id: I6d220bc2d0289070f3441adb48983c13b2a3e597 Reviewed-on: https://go-review.googlesource.com/c/go/+/732940 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Richard Miller <millerresearch@gmail.com> Reviewed-by: Alan Donovan <adonovan@google.com> Auto-Submit: Alan Donovan <adonovan@google.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2026-01-12net: fix socket duplication error handling on Windowsqmuntal
Calls to dupSocket may fail, but the error is not properly handled because the surrounding code incorrectly checks for nil error instead of non-nil error. I'm not aware of any code paths that would trigger this error, and I haven't been able to create a test case that does so, but this change fixes the error handling to correctly propagate any errors from dupSocket. Change-Id: I5ffd3cbe8ed58a83634f3b97c0878a7c73e0505e Reviewed-on: https://go-review.googlesource.com/c/go/+/734821 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-01-12net: don't ignore getsockname errors in newFileFDqmuntal
newFileFD is called when creating a net FD from an existing socket handle. That socket might not be bound yet, in which case getsockname returns a useful error that is currently ignored and replaced with a potentially misleading EPROTONOSUPPORT error later on. Updates #73696 Updates #74976 Updates #75282 Updates #75279 Updates #76537 Updates #76582 Updates #77038 Change-Id: I2a8b30ffbb037035669f65a95a923edc8b288145 Reviewed-on: https://go-review.googlesource.com/c/go/+/734820 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-01-12net: don't ignore errors in TestUnixUnlinkqmuntal
TestUnixUnlink calls some functions and methods that can fail, but it ignores the returned errors. This test is flaky on Windows, and those errors should be checked to help diagnose the problem. Updates #75282 Updates #76582 Updates #77038 Change-Id: Ia868762a4c0b94a7255d57add63777568caa6cd2 Reviewed-on: https://go-review.googlesource.com/c/go/+/734720 Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2026-01-12crypto: use testenv.Executable(t) instead of os.Args[0] in testsFilippo Valsorda
Change-Id: Ib0ec1f05e51a4295a9369d6e8c6b61976a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/735260 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com>
2026-01-12spec: slightly re-arrange composite literal section for readabilityRobert Griesemer
- introduce subtitles to make various sub-sections easier to find - split rules for struct literals into two groups (literals without and with keys) - move section on syntax ambiguity up as it pertains to the syntax introduced at the start - move prose specific to map literals into its own section No language changes. Change-Id: If8895b869138693179ca6e4d8b1c6ebdc705eccf Reviewed-on: https://go-review.googlesource.com/c/go/+/734322 Reviewed-by: Alan Donovan <adonovan@google.com> Auto-Submit: Robert Griesemer <gri@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Robert Griesemer <gri@google.com>
2026-01-09cmd/dist: fix goroot typo in panic messagejjpinto
Change-Id: I636a029eedaab0967b774648670710d1303a1f7c GitHub-Last-Rev: 519faedc5b8327696efeeb431ef66e9fd29f0db7 GitHub-Pull-Request: golang/go#77081 Reviewed-on: https://go-review.googlesource.com/c/go/+/734080 Reviewed-by: Ian Lance Taylor <iant@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2026-01-09path/filepath: Match: improve doc commentAlan Donovan
Change-Id: Ic7a6e11ddeb79af67ece345405cdca6cf5199173 Reviewed-on: https://go-review.googlesource.com/c/go/+/735180 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Alan Donovan <adonovan@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-09crypto/rsa: log key on test failureFilippo Valsorda
For #74326 Change-Id: If1e61db22c9e7192e5dd56cd36141e5b6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/734640 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-09cmd/go: only use check cache action's dependencies to build vet configMichael Matloob
We manipulate the dependencies of the build action when adding the non-test variant of the package being tested as a dependency for the test, so the set of deps of the build package doesn't correctly represent the dependencies of the package that have been built. Restrict the set of dependencies we use to populate the vet data to the actual build dependencies depended on by the check cache action so we don't check an action that we don't actually depend on (and which may not have completed yet!) Fixes #75380 Change-Id: I029080d00b3b10a837abcfb7039e00206a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/734961 Reviewed-by: Michael Matloob <matloob@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-08runtime/trace: fix documentation commentjjpinto
Correct documentation comment for mul function Change-Id: I8b90f02bf0aaba9bb5813833d1b9dd1ebb7d71f4 GitHub-Last-Rev: e91af64af9bad9cd2574dc3dd7ed88123a288be8 GitHub-Pull-Request: golang/go#77082 Reviewed-on: https://go-review.googlesource.com/c/go/+/734100 Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2026-01-08[release-branch.go1.26] all: merge master (6b2505c) into release-branch.go1.26Junyang Shao
Merge List: + 2026-01-08 6b2505c79c cmd/go: remove user-content from doc strings in cgo ASTs. + 2026-01-08 4b89bcb8b7 lib/fips140: freeze v1.26.0 FIPS 140-3 module + 2026-01-08 8ac4477d83 simd/archsimd: rename Broadcast methods + 2026-01-08 5facb3b24b internal/types: add test for cycles in value context + 2026-01-07 28147b5283 cmd/go: guarantee a minimum of min(4,GOMAXPROCS) to compile -c + 2026-01-07 874d8b98eb cmd/go/internal/work: decrement concurrentProcesses when action finishes + 2026-01-07 d1e7f49e3d internal/trace: fix recorder.Write return value for header-only buffers Change-Id: I863375a1ac0f641b0b02968acf01a602b7d7f2a1
2026-01-08cmd/go: remove user-content from doc strings in cgo ASTs.Neal Patel
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Updates golang/go#76697 Fixes CVE-2025-61732 Change-Id: I1121502f1bf1e91309eb4bd41cc3a09c39366d36 Reviewed-on: https://go-review.googlesource.com/c/go/+/734220 Reviewed-by: Agustin Hernandez <garisol1982@gmail.com> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Robert Griesemer <gri@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-08lib/fips140: freeze v1.26.0 FIPS 140-3 moduleFilippo Valsorda
Fixes #76770 Change-Id: Ia617f01ea9be0d1759147b6cca0403c56a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/731840 Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Junyang Shao <shaojunyang@google.com>
2026-01-08simd/archsimd: rename Broadcast methodsCherry Mui
Currently the Broadcast128/256/512 methods broadcast the lowest element of the input vector to a vector of the corresponding width. There are also variations of broadcast operations that broadcast the whole (128- or 256-bit) vector to a larger vector, which we don't yet support. Our current naming is unclear which version it is, though. Rename the current ones to Broadcast1ToN, to be clear that they broadcast one element. The vector version probably will be named BoradcastAllToN (not included in this CL). Change-Id: I47a21e367f948ec0b578d63706a40d20f5a9f46d Reviewed-on: https://go-review.googlesource.com/c/go/+/734840 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 03:27:21 +0000