commit 08118a942518cc18db507ec182acffe7364a92a3 [browse]
Author: Gopher Robot
Date: 2026-08-19 07:36:29 -07:00

[release-branch.go1.25] go1.25.14

Change-Id: I9e3fddf67829ff8d68e49f38b44e298327d554db
Reviewed-on: https://go-review.googlesource.com/c/go/+/817740
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>

commit a3c8d44d17035627832ea3e367572fa9a120d680 [browse]
Author: Damien Neil
Date: 2026-08-17 11:11:52 -07:00

[release-branch.go1.25] net/http: clear ReadHeaderTimeout after accepting an unencrypted h2 conn

Fix a bug where a new unencrypted HTTP/2 connection would leave
ReadHeaderTimeout set on the underlying net.Conn, causing the connection
to close abruptly when the timeout expired.

Consistently clear the net.Conn's timeouts before passing a Conn off
to the http2 package.

The new test is adapted from CL 815300 by Benno Moskovitz.

For #80876
Fixes #80926

Change-Id: I42ae5bd678a1cd44879ecc28895b90896a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/816600
Reviewed-by: Nicholas Husin <husin@google.com>
Auto-Submit: Damien Neil <dneil@google.com>
Reviewed-by: Nicholas Husin <nsh@golang.org>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/817200
TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>

commit 01955f958ac8c3da7d3d6ea7f3bdb65409cd5133 [browse]
Author: Dmitri Shuralyov
Date: 2026-08-13 18:20:41 -04:00

[release-branch.go1.25] cmd/internal/moddeps: restore tests

By now PRIVATE-track security fixes involving a vendored package
have been released, and these tests can be made to run again.

For #80764.
For #80766.

[git-generate]
updatestd -goroot=$(pwd) -branch=internal-branch.go1.25-vendor
sed -i '' '/t.Skip()/d' src/cmd/internal/moddeps/moddeps_test.go

Change-Id: Ifa25aa7f51a4a8527aee10982e967a595a36a878
Reviewed-on: https://go-review.googlesource.com/c/go/+/815101
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Neal Patel <nealpatel@google.com>

commit f893f2702891503a0c7ff615af3abb5efc1c480d [browse]
Author: Gopher Robot
Date: 2026-08-13 10:29:33 -07:00

[release-branch.go1.25] go1.25.13

Change-Id: I4b70d995adc305fd68e4dfc6bc5c42cd001513b5
Reviewed-on: https://go-review.googlesource.com/c/go/+/814722
Reviewed-by: Mark Freeman <mark@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>

commit b0b8c97d1386bb3eb978e727ed0b1df8e14df569 [browse]
Author: Neal Patel
Date: 2026-08-07 00:23:22 Z

[release-branch.go1.25] cmd/vendor: fix CVE-2026-56865 in x/mod

Fixes #80744
Fixes CVE-2026-56865

Change-Id: I1e063053041c2d88b7801bfe09b6060f4def6afe
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5140
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/5220
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/814822
Reviewed-by: Mark Freeman <mark@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>