Activity
Today
dmitshur commented on golang.org/x/vulndb/go.mod: update github.com/go-git/go-git30m
(1 comment)
Is it expected that `go mod tidy` seemingly undoes this change (because the newly added requirements are only indirectly used)? This repo seems to use go-git/v5.dmitshur commented on net/http: [release-branch.go1.25] clear ReadHeaderTimeout after accepting an unencrypted h2 conn37m
Patchset 3 passed all trybots, except go1.25-wasip1-wasm_wasmtime failed in time package due a timeout. It doesn't seem related, and it passed on second try, so adding bypass.dmitshur commented on crypto/tls: client handshake tests hardcode TLSv1.0 [1.27 backport]56m
Moved this back to Go1.27.1 milestone to reflect today's discussion in a release meeting.dmitshur commented on cmd/compile/internal/test: TestMergeLocalsIntegration fails on s390x in go1.26.61h
This looks related to issue #80484. It already has backport CLs in progress at [CL 812920](https://go.dev/cl/812920) and [CL 812920](https://go.dev/cl/812920), can you please check if those are enoug…dmitshur commented on cmd/internal/obj/x86: don't use LEAVE on plan9/amd642h
I'm not sure if retrying trybots will help. This passed on all trybots other than gotip-plan9-amd64 itself, but gotip-plan9-amd64 has a still-open known issue #63600 and it hasn't been green at https…dmitshur commented on cmd/asm: riscv64 VRORVI rejects valid immediate values from 32 to 632h
CC @golang/riscv64.dmitshur commented on cmd/compile: internal compiler error with >1000 package-level vars and multi-return function call4h
@Jorropo Are you referring to the fix in [CL 737880](https://go.dev/cl/737880) that was reverted (in [CL 794180](https://go.dev/cl/794180))? If so, that fix originally fixed issue #77153, and that is…dmitshur commented on crypto/tls: client handshake tests hardcode TLSv1.04h
CC @golang/security, @golang/release.dmitshur reviewed +2 on golang.org/x/mobile/cmd/gomobile: invoke the NDK Clang directly6h
Thanks.dmitshur reviewed +2 on golang.org/x/benchmarks/cmd/bent: lower default go.mod version to 1.256h
Thanks.
We'll stop very soon, after Go 1.27.0 is released. But that indeed hasn't happened quite yet.dmitshur fixed an issue access: add new members to port-maintainers/s390x team7h
I see both invitations have been accepted, so this should be done. Please comment if something got missed. Thanks.dmitshur commented on access: add new members to port-maintainers/s390x team7h
I see both invitations have been accepted, so this should be done. Please comment if something got missed. Thanks.dmitshur reviewed +2 on golang.org/x/build/dashboard: update owners for host-linux-s390x7h
Thanks.
Please consider adding a reference to issue #80843 here. That way it may be easier to find if someone needs to.
```
For golang/go#80843.
```Yesterday
dmitshur commented on golang.org/x/website/_content/doc/go1.24: fix typo22h
This passed on most builders; the few failure are due to unrelated 500s from Gerrit rather than the change content.dmitshur reviewed +2 on golang.org/x/build/main.star: add goamd64v3 perf builders1d
Thanks.
Do you know if having GOAMD64=v3 set in the environment will be enough and propagate to the rest of the perf tooling, without being cleared away for a consistent performance benchmarking sta…dmitshur commented on access: add new members to port-maintainers/s390x team1d
Thanks for your work on maintaining the GOARCH=s390x port. @kmvijay-IBM and @prophet6250 should now have invitations to join the @golang/s390x team.dmitshur commented on access: add new members to port-maintainers/s390x team1d
CC @golang/release, @golang/s390x.dmitshur fixed an issue access: may-start-trybots for sunny@golang.org1d
Your golang.org account should work now.dmitshur reviewed +2 on golang.org/x/build/devapp/owners: remove commandlineTeam and replace with matloob1d
Thanks.
Something to consider: a "release" team doesn't exist either, but we kept the GitHub team behind and repurposed it to be, as it's currently described:
> Members of this team are notified vi…dmitshur commented on golang.org/x/build/internal/perf: add "|" to InfluxDB allowed-in-string chars1d
(1 comment)
Something like this, perhaps:
```suggestion
var validateRe = regexp.MustCompile(`^[a-zA-Z0-9(),=/_:;.-|]+$`)
```dmitshur commented on golang.org/x/build/internal/perf: add "|" to InfluxDB allowed-in-string chars1d
(1 comment)
Oh, is the newly permitted '|' meant to go before the '$' (end of string)?dmitshur reviewed +2 on golang.org/x/build/internal/perf: add "|" to InfluxDB allowed-in-string chars1d
Thanks.This Week
dmitshur commented on github.com/mdempsky/unconvert/...: update go and dependency versions1d
Thanks.dmitshur deleted branch in github.com/mdempsky/unconvert1d
go-126-125dmitshur merged a change github.com/mdempsky/unconvert/...: update go and dependency versions2d
dmitshur commented on golang.org/x/website/internal/dl: sort multi-digit prerelease versions numerically2d
(1 comment)
```suggestion
Fixes golang/go#80907
```dmitshur commented on golang.org/x/website/internal/dl: sort multi-digit prerelease versions numerically2d
(2 comments)
This works, but given version.Compare exists, we could replace the entire versionLess helper with it.
So, please delete versionLess entirely, and in the places that currently use versi…dmitshur reviewed +2 on golang.org/x/review/...: remove double space in copyright headers2d
Thanks.
From a [quick search](https://cs.opensource.google/search?q=%22The%20Go%20Authors.%20%20All%20rights%20reserved.%22&sq=&ss=go), there may be a few more repos like x/arch, x/debug, x/perf tha…dmitshur opened a change github.com/mdempsky/unconvert/...: update go and dependency versions2d
Using too old of an x/tools version causes newer toolchains such as go1.27rc3 to run into errors like 'internal error: package "strings" without types was imported'. Updating to a newer x/tools versi…dmitshur created branch in github.com/mdempsky/unconvert2d
go-126-125Last Week
dmitshur opened a change os: [release-branch.go1.25] don't symlink on Root.Mkdir("symlink/") on openbsd3d
POSIX says you follow the symlink, but some platforms don't.
Add OpenBSD to the list of ones that don't.
For #80386.
Fixes #80888.dmitshur opened a change os: [release-branch.go1.26] don't symlink on Root.Mkdir("symlink/") on openbsd3d
POSIX says you follow the symlink, but some platforms don't.
Add OpenBSD to the list of ones that don't.
For #80386.
Fixes #80889.dmitshur opened a change os: [release-branch.go1.27] don't symlink on Root.Mkdir("symlink/") on openbsd3d
POSIX says you follow the symlink, but some platforms don't.
Add OpenBSD to the list of ones that don't.
Fixes #80386.dmitshur commented on os: TestRootMultiMkdirAllShallow failures on openbsd [consistent failure]3d
This is already fixed for Go 1.28 by [CL 800700](https://go.dev/cl/800700), but it still happens on release branches.
@gopherbot Please consider this for backport. It's a small OpenBSD-only change t…dmitshur commented on golang.org/x/oauth2/google: change the snake case endpoint to kebab-case4d
Done in patchset 4.
Fix applied.dmitshur reviewed +2 on golang.org/x/build/buildlet: ensure bytes are drained before network connection4d
Thanks.
I find this description a little unclear since it doesn't say which bytes.
My current understanding is that the /connect-ssh HTTP handler first writes an HTTP response to the POST request, …dmitshur commented on golang.org/x/build/cmd/relui: automate process of upstreaming private-track security CLs on release day (for the main branch)4d
@rhysh made a suggestion to consider sending an email to golang-dev to notify Go developers at tip when the PRIVATE-track security fixes have finished landing. Adding a note here since this would be …dmitshur commented on golang.org/x/net/idna: New(VerifyDNSLength(true)).ToASCII rejects hosts that contain a trailing period4d
This issue is currently in the Unreleased milestone, meaning it's only associated with the golang.org/x/net module and not the main Go release cycle. Is it expected that the fix will be inside the x/…dmitshur commented on cmd/compile: [release-branch.go1.27] do not home mul/div results in HI/LO4d
Done. We decided this is okay for go1.27.0.dmitshur commented on cmd/compile: [release-branch.go1.25] fix up backport of CL 8032404d
Minor release is done, dropping hold.
This backport CL is ready, but CL 812920 still needs a review.dmitshur commented on cmd/compile: [release-branch.go1.26] fix up backport of CL 8032404d
Minor release is done, dropping hold.dmitshur commented on encoding/json/v2: [release-branch.go1.27] modify documentation4d
Done.dmitshur commented on encoding/json/v2: [release-branch.go1.27] add MarshalerTo and UnmarshalerFrom examples4d
Done.dmitshur commented on encoding/json/v2: [release-branch.go1.27] make Deterministic doc more approachable4d
Done.dmitshur commented on encoding/json/jsontext: [release-branch.go1.27] clarify safety of AvailableBuffer4d
Done.dmitshur commented on encoding/json/v2: remove guarantee of cyclic data structure detection from documentation4d
Thanks @prattmic. [CL 813920](https://go.dev/cl/813920) is in but has "For" rather than "Fixes". Is there more for this issue?dmitshur commented on internal/stringslite: [release-branch.go1.27] fix performance regression in index4d
Done. We decided this is okay for go1.27.0.dmitshur commented on golang.org/x/tools/internal/refactor/inline: reduce void calls in tail position4d
I'm not the right reviewer for this change, moving myself to CC.dmitshur commented on golang.org/x/vulndb/x/vulndb: suggestion regarding <GO-2026-5942>4d
CC @thatnealpatel.dmitshur commented on cmd/go: go doc -http broken at tip and 1.27rc34d
> I'm surprised there isn't a failing test.
I suspect current test didn't catch a bad `pkgsiteCmdInternalDocVersion` constant value because it overrides the real pkgsite binary and its version with …dmitshur commented on cmd/internal/moddeps: [release-branch.go1.27] restore tests4d
runtime:mayMoreStackMove.TestCoroLockOSThread/CoroLockOSThreadStopLockedIterNested failed on linux-arm64-longtest, otherwise everything passed. That failure is unrelated to this change.dmitshur commented on all: update vendored x/mod4d
gotip-windows-386 timed out while testing the net/http/pprof package, not related to the change here. It passed on second try.dmitshur opened a change cmd/internal/moddeps: [release-branch.go1.26] restore tests4d
By now PRIVATE-track security fixes involving a vendored package
have been released, and these tests can be made to run again.
For #80765.
For #80767.
[git-generate]
updatestd -goroot=$(pwd) -branc…dmitshur opened a change cmd/internal/moddeps: [release-branch.go1.27] restore tests4d
By now PRIVATE-track security fixes involving a vendored package
have been released, and these tests can be made to run again.
For #80744.
For #80745.
[git-generate]
updatestd -goroot=$(pwd) -branc…dmitshur opened a change all: update vendored x/mod5d
Pull in the following x/mod changes:
- CL 814960: sumdb/tlog: fix TileHashReader authentication bypass
- CL 815000: sumdb: ignore unrelated hashes in Lookup
Fixes #80744.
Fixes #80745.
Fixes CVE-20…dmitshur opened a change encoding/asn1: enforce maximum recursion depth5d
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this
issue.
Fixes…dmitshur fixed an issue security: fix CVE-2026-56865 [1.25 backport]5d
Closed by merging [CL 814822](https://go.dev/cl/814822) (commit b0b8c97d1386bb3eb978e727ed0b1df8e14df569) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56865 [1.25 backport]5d
Closed by merging [CL 814822](https://go.dev/cl/814822) (commit b0b8c97d1386bb3eb978e727ed0b1df8e14df569) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56865 [1.26 backport]5d
Closed by merging [CL 814802](https://go.dev/cl/814802) (commit 115eb476aaca4531374c42e19e6f199265c2e25e) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-56865 [1.26 backport]5d
Closed by merging [CL 814802](https://go.dev/cl/814802) (commit 115eb476aaca4531374c42e19e6f199265c2e25e) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-56864 [1.25 backport]5d
Closed by merging [CL 814821](https://go.dev/cl/814821) (commit 22e01669cdcabb9cfad02e0c2bffbce8198f6bfb) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56864 [1.25 backport]5d
Closed by merging [CL 814821](https://go.dev/cl/814821) (commit 22e01669cdcabb9cfad02e0c2bffbce8198f6bfb) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56864 [1.26 backport]5d
Closed by merging [CL 814801](https://go.dev/cl/814801) (commit 9f6980fd5c03840b0f6764e8ec7c705b90989eee) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-56864 [1.26 backport]5d
Closed by merging [CL 814801](https://go.dev/cl/814801) (commit 9f6980fd5c03840b0f6764e8ec7c705b90989eee) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-33818 [1.25 backport]5d
Closed by merging [CL 814820](https://go.dev/cl/814820) (commit 8d01cbaad59021bd6d4f6e2dd864413872434250) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-33818 [1.25 backport]5d
Closed by merging [CL 814820](https://go.dev/cl/814820) (commit 8d01cbaad59021bd6d4f6e2dd864413872434250) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-33818 [1.26 backport]5d
Closed by merging [CL 814800](https://go.dev/cl/814800) (commit 6ec908dd240103f222620a222bc8a4c3e2c33718) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-33818 [1.26 backport]5d
Closed by merging [CL 814800](https://go.dev/cl/814800) (commit 6ec908dd240103f222620a222bc8a4c3e2c33718) to release-branch.go1.26.dmitshur opened a change golang.org/x/website/internal/history: document Go 1.26.6 and Go 1.25.135d
dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.25 backport]5d
Closed by merging [CL 811000](https://go.dev/cl/811000) (commit cafd3448c7cb0b2d793bb4144d58f72ef3f48327) to release-branch.go1.25.
CC @golang/release, @mrkfrmn.dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.25 backport]5d
Closed by merging [CL 811000](https://go.dev/cl/811000) (commit cafd3448c7cb0b2d793bb4144d58f72ef3f48327) to release-branch.go1.25.
CC @golang/release, @mrkfrmn.dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.26 backport]5d
Closed by merging [CL 811020](https://go.dev/cl/811020) (commit 33ecb966ca47e55034272a9146e23e9909507f6d) to release-branch.go1.26.
CC @golang/release, @mrkfrmn.dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.26 backport]5d
Closed by merging [CL 811020](https://go.dev/cl/811020) (commit 33ecb966ca47e55034272a9146e23e9909507f6d) to release-branch.go1.26.
CC @golang/release, @mrkfrmn.dmitshur commented on html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{`5d
> I'm under the impression that to participate in the minors, this needs backports.
Indeed, all minor release fixes need a corresponding backport issue. In addition to tracking, the backport issues …dmitshur commented on html/template: iframe srcdoc attribute not properly escaped5d
As far as I can tell, this wasn't intended to be added the Go1.26.5 milestone since it has no CherryPickCandidate label nor "[1.26 backport]" suffix in title, and it doesn't seem to fixed at tip yet.…dmitshur commented on text/template/parse: continue instead of return on TestLex failure6d
Thanks.dmitshur closed an issue cmd/go/internal: fix copy paste error6d
Thanks for the information. Since [CL 762500](https://go.dev/cl/762500) didn't have an issue associated, I filed #80850 for it retroactively and used it for the backport.dmitshur commented on cmd/go: pseduo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.266d
@gopherbot Please consider this for backport to Go 1.26. There's a semi-workaround available by using `CXXFLAGS` to control Fortran flags, but that can only be used if C++ flags aren't needed, and a …dmitshur fixed an issue cmd/go: pseduo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.266d
dmitshur opened an issue cmd/go: pseduo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.266d
https://pkg.go.dev/cmd/cgo#hdr-Using_cgo_with_the_go_command documents the behavior:
> CFLAGS, CPPFLAGS, CXXFLAGS, FFLAGS and LDFLAGS may be defined with pseudo #cgo directives within these comments…dmitshur commented on golang.org/x/build/cmd/watchflakes: stop posting flakes to the issue tracker6d
CC @golang/release, @cherrymui.dmitshur commented on cmd/go/internal: fix copy paste error6d
Please see https://go.dev/wiki/MinorReleases for the backport process.
We'll need more information to consider a backport request, anything that would help us understand why a backport might be warr…dmitshur closed an issue golang.org/x/crypto: cut a new release6d
dmitshur reviewed +2 on cmd/dist: build one more toolchain when GOEXPERIMENT is set6d
Thanks.
Consider requiring at least one builder that's running into this, e.g.:
```suggestion
Change-Id: I47aed66bc30fda86366042cbf8fcc32e6a6a6964
Cq-Include-Trybots: luci.golang.try:gotip-linux-am…dmitshur commented on cmd/compile: [release-branch.go1.25] fix up backport of CL 8032401w
linux-arm passed in patch set 3.
Temporary hold while release branches are frozen for https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs.dmitshur commented on cmd/compile: [release-branch.go1.26] fix up backport of CL 8032401w
linux-arm passed in patch set 2.
Temporary hold while release branches are frozen for https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs.dmitshur commented on golang.org/x/build/cmd/relui: automate security comms inputs using security metadata1w
One of the remaining enhancements here is to re-check for any updates to the release notes when sending the announcement, so that it'd pick up any improvements to the release notes that may happen. (…dmitshur commented on cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames1w
It was noted at https://groups.google.com/g/golang-dev/c/jMWTCiV0aSk/m/Qo6ozI0dBQAJ:
> Any CLs that land after CL 800721 ("internal/goversion: update Version to 1.28") but target go1.27.0 must be ch…dmitshur reviewed +2 on cmd/dist: don't rebuild the toolchain with a clean cache1w
Thanks.
Thanks for checking. I asked because keeping these comments up to date will help with future maintenance of this sequence, and it seemed worth some extra attention.
This part seems out of d…dmitshur commented on golang.org/x/mobile/cmd/gomobile: Android archives use backslashes in nested asset paths on Windows1w
CC @hajimehoshi.dmitshur commented on net: BenchmarkTCP4OneShot produces bimodal results across repeated runs1w
CC @ianlancetaylor, @neild, @nicholashusin.dmitshur commented on golang.org/x/mobile/cmd/gomobile: bind does not apply source overlays consistently1w
CC @hajimehoshi.dmitshur commented on proxy.golang.org: go mod download fails with 403 Forbidden from proxy.golang.org1w
CC @golang/tools-team.dmitshur commented on net/http: ParseSetCookie fails to parse Path values accepted by Cookie.Valid1w
CC @neild, @nicholashusin.dmitshur commented on cmd/internal/quoted: Join does not preserve empty arguments1w
CC @golang/command-line.dmitshur commented on mime: FormatMediaType emits duplicate parameters for keys differing only by case1w
CC @neild.dmitshur commented on crypto/tls: could save 45 bytes on the default ClientHello when `MinVersion` is `3`1w
CC @golang/security.dmitshur commented on net/http: HTTP/2 read loop spins at 100% CPU on a StreamError cached by tls.Conn1w
CC @neild, @nicholashusin.dmitshur commented on encoding/xml: unrecognized failures1w
CC @golang/mips.dmitshur commented on golang.org/x/crypto: cut a new release1w
Yes, this month's 'Tag x/ repos' relui workflow (#48523) is running this week, and it will tag the next golang.org/x/crypto version.