commit 56ebf80e57db9f61981fc0636fc6419dc6f68eda [browse]
Author: Gopher Robot
Date: 2025-09-03 10:39:10 -07:00

[release-branch.go1.25] go1.25.1

Change-Id: I93a703d161b821cf7a78934f8711416ac6b00485
Reviewed-on: https://go-review.googlesource.com/c/go/+/700736
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Michael Pratt <mpratt@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>

commit b1959cf6f7673eaffa89bbdb00e68b30cde3aa8a [browse]
Author: Filippo Valsorda
Date: 2025-08-26 16:52:39 -04:00

[release-branch.go1.25] net/http: require exact match for CrossSiteProtection bypass patterns

Fixes #75160
Updates #75054
Fixes CVE-2025-47910

Change-Id: I6a6a696440c45c450d2cd681f418b01aa0422a60
Reviewed-on: https://go-review.googlesource.com/c/go/+/699276
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

commit cdd8cf4988c7c0f2bb8eb795f74c4f803c63a70d [browse]
Author: database64128
Date: 2025-07-25 15:14:16 +08:00

[release-branch.go1.25] net: fix WriteMsgUDPAddrPort addr handling on IPv4 sockets

Accept IPv4-mapped IPv6 destination addresses on IPv4 UDP sockets.

Fixes #74999.

Change-Id: I4624b9b8f861aedcae29e51d5298d23ce1c0f2c7
Reviewed-on: https://go-review.googlesource.com/c/go/+/689976
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Mark Freeman <markfreeman@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit bdb2d50fdf40706e7d7411f33ade80edac726707)
Reviewed-on: https://go-review.googlesource.com/c/go/+/695875
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>

commit 8995e84ac64dd5d614f851a60d97ba026a9e6fb1 [browse]
Author: qmuntal
Date: 2025-08-19 12:10:54 +02:00

[release-branch.go1.25] internal/poll: set the correct file offset in FD.Seek for Windows overlapped handles

Windows doesn't keep the file pointer for overlapped file handles. To
work around this, we keep track of the current offset ourselves and use
it on every Read/Write operation.

When the user calls File.Seek with whence == io.SeekCurrent, it expects
that the offset we keep track of is also accounted for, else the the
seek'ed value won't match the file pointer seen by the user.

Fixes #75083.

Change-Id: Ieca7c3779e5349292883ffc293a8474088a4dec7
Reviewed-on: https://go-review.googlesource.com/c/go/+/697275
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
(cherry picked from CL 697275)
Reviewed-on: https://go-review.googlesource.com/c/go/+/697995

commit 749dff880af3e7ac0b41fbc6a41cfb6fff6e80b9 [browse]
Author: Damien Neil
Date: 2025-08-14 10:27:54 -07:00

[release-branch.go1.25] runtime: make all synctest bubble violations fatal panics

Unblocking a bubbled goroutine from outside the bubble is an error
and panics. Currently, some of those panics are regular panics
and some are fatal. We use fatal panics in cases where its difficult
to panic without leaving something in an inconsistent state.

Change the regular panics (channel and timer operations) to be fatal.

This makes our behavior more consistent: All bubble violations are
always fatal.

More importantly, it avoids introducing new, recoverable panics.
A motivating example for this change is the context package,
which performs channel operations with a mutex held in the
expectation that those operations can never panic. These operations
can now panic as a result of a bubble violation, potentially
leaving a context.Context in an inconsistent state.

For #74837
Fixes #75021

Change-Id: Ie6efd916b7f505c0f13dde42de1572992401f15c
Reviewed-on: https://go-review.googlesource.com/c/go/+/696195
Auto-Submit: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
(cherry picked from commit a8564bd412d4495a6048f981d30d4d7abb1e45a7)
Reviewed-on: https://go-review.googlesource.com/c/go/+/696196