Activity
Today
dmitshur commented on golang.org/x/build/cmd/relui: automate process of upstreaming private-track security CLs on release day (for the main branch)36m
@rhysh made a suggestion to consider sending an email to golang-dev to notify Go developers at tip when the PRIVATE-track security fixes have finished landing. Adding a note here since this would be …dmitshur commented on golang.org/x/net/idna: New(VerifyDNSLength(true)).ToASCII rejects hosts that contain a trailing period50m
This issue is currently in the Unreleased milestone, meaning it's only associated with the golang.org/x/net module and not the main Go release cycle. Is it expected that the fix will be inside the x/…dmitshur commented on cmd/compile: [release-branch.go1.27] do not home mul/div results in HI/LO58m
Done. We decided this is okay for go1.27.0.dmitshur commented on cmd/compile: [release-branch.go1.25] fix up backport of CL 8032401h
Minor release is done, dropping hold.
This backport CL is ready, but CL 812920 still needs a review.dmitshur commented on cmd/compile: [release-branch.go1.26] fix up backport of CL 8032401h
Minor release is done, dropping hold.dmitshur commented on encoding/json/v2: [release-branch.go1.27] modify documentation1h
Done.dmitshur commented on encoding/json/v2: [release-branch.go1.27] add MarshalerTo and UnmarshalerFrom examples1h
Done.dmitshur commented on encoding/json/v2: [release-branch.go1.27] make Deterministic doc more approachable1h
Done.dmitshur commented on encoding/json/jsontext: [release-branch.go1.27] clarify safety of AvailableBuffer1h
Done.dmitshur commented on encoding/json/v2: remove guarantee of cyclic data structure detection from documentation1h
Thanks @prattmic. [CL 813920](https://go.dev/cl/813920) is in but has "For" rather than "Fixes". Is there more for this issue?dmitshur commented on internal/stringslite: [release-branch.go1.27] fix performance regression in index2h
Done. We decided this is okay for go1.27.0.dmitshur commented on golang.org/x/tools/internal/refactor/inline: reduce void calls in tail position2h
I'm not the right reviewer for this change, moving myself to CC.dmitshur commented on golang.org/x/vulndb/x/vulndb: suggestion regarding <GO-2026-5942>2h
CC @thatnealpatel.Yesterday
dmitshur commented on cmd/go: go doc -http broken at tip and 1.27rc317h
> I'm surprised there isn't a failing test.
I suspect current test didn't catch a bad `pkgsiteCmdInternalDocVersion` constant value because it overrides the real pkgsite binary and its version with …dmitshur commented on cmd/internal/moddeps: [release-branch.go1.27] restore tests17h
runtime:mayMoreStackMove.TestCoroLockOSThread/CoroLockOSThreadStopLockedIterNested failed on linux-arm64-longtest, otherwise everything passed. That failure is unrelated to this change.dmitshur commented on all: update vendored x/mod18h
gotip-windows-386 timed out while testing the net/http/pprof package, not related to the change here. It passed on second try.dmitshur opened a change cmd/internal/moddeps: [release-branch.go1.26] restore tests18h
By now PRIVATE-track security fixes involving a vendored package
have been released, and these tests can be made to run again.
For #80765.
For #80767.
[git-generate]
updatestd -goroot=$(pwd) -branc…dmitshur opened a change cmd/internal/moddeps: [release-branch.go1.27] restore tests18h
By now PRIVATE-track security fixes involving a vendored package
have been released, and these tests can be made to run again.
For #80744.
For #80745.
[git-generate]
updatestd -goroot=$(pwd) -branc…dmitshur opened a change all: update vendored x/mod21h
Pull in the following x/mod changes:
- CL 814960: sumdb/tlog: fix TileHashReader authentication bypass
- CL 815000: sumdb: ignore unrelated hashes in Lookup
Fixes #80744.
Fixes #80745.
Fixes CVE-20…dmitshur opened a change encoding/asn1: enforce maximum recursion depth22h
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this
issue.
Fixes…dmitshur fixed an issue security: fix CVE-2026-56865 [1.25 backport]22h
Closed by merging [CL 814822](https://go.dev/cl/814822) (commit b0b8c97d1386bb3eb978e727ed0b1df8e14df569) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56865 [1.25 backport]22h
Closed by merging [CL 814822](https://go.dev/cl/814822) (commit b0b8c97d1386bb3eb978e727ed0b1df8e14df569) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56865 [1.26 backport]22h
Closed by merging [CL 814802](https://go.dev/cl/814802) (commit 115eb476aaca4531374c42e19e6f199265c2e25e) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-56865 [1.26 backport]22h
Closed by merging [CL 814802](https://go.dev/cl/814802) (commit 115eb476aaca4531374c42e19e6f199265c2e25e) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-56864 [1.25 backport]22h
Closed by merging [CL 814821](https://go.dev/cl/814821) (commit 22e01669cdcabb9cfad02e0c2bffbce8198f6bfb) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56864 [1.25 backport]22h
Closed by merging [CL 814821](https://go.dev/cl/814821) (commit 22e01669cdcabb9cfad02e0c2bffbce8198f6bfb) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-56864 [1.26 backport]22h
Closed by merging [CL 814801](https://go.dev/cl/814801) (commit 9f6980fd5c03840b0f6764e8ec7c705b90989eee) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-56864 [1.26 backport]22h
Closed by merging [CL 814801](https://go.dev/cl/814801) (commit 9f6980fd5c03840b0f6764e8ec7c705b90989eee) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-33818 [1.25 backport]22h
Closed by merging [CL 814820](https://go.dev/cl/814820) (commit 8d01cbaad59021bd6d4f6e2dd864413872434250) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-33818 [1.25 backport]22h
Closed by merging [CL 814820](https://go.dev/cl/814820) (commit 8d01cbaad59021bd6d4f6e2dd864413872434250) to release-branch.go1.25.dmitshur fixed an issue security: fix CVE-2026-33818 [1.26 backport]23h
Closed by merging [CL 814800](https://go.dev/cl/814800) (commit 6ec908dd240103f222620a222bc8a4c3e2c33718) to release-branch.go1.26.dmitshur fixed an issue security: fix CVE-2026-33818 [1.26 backport]23h
Closed by merging [CL 814800](https://go.dev/cl/814800) (commit 6ec908dd240103f222620a222bc8a4c3e2c33718) to release-branch.go1.26.dmitshur opened a change golang.org/x/website/internal/history: document Go 1.26.6 and Go 1.25.1323h
dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.25 backport]1d
Closed by merging [CL 811000](https://go.dev/cl/811000) (commit cafd3448c7cb0b2d793bb4144d58f72ef3f48327) to release-branch.go1.25.
CC @golang/release, @mrkfrmn.dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.25 backport]1d
Closed by merging [CL 811000](https://go.dev/cl/811000) (commit cafd3448c7cb0b2d793bb4144d58f72ef3f48327) to release-branch.go1.25.
CC @golang/release, @mrkfrmn.dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.26 backport]1d
Closed by merging [CL 811020](https://go.dev/cl/811020) (commit 33ecb966ca47e55034272a9146e23e9909507f6d) to release-branch.go1.26.
CC @golang/release, @mrkfrmn.dmitshur fixed an issue html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{` [1.26 backport]1d
Closed by merging [CL 811020](https://go.dev/cl/811020) (commit 33ecb966ca47e55034272a9146e23e9909507f6d) to release-branch.go1.26.
CC @golang/release, @mrkfrmn.dmitshur commented on html/template: potential XSS caused by wrong JavaScript regexp context tracking after top-level `{`1d
> I'm under the impression that to participate in the minors, this needs backports.
Indeed, all minor release fixes need a corresponding backport issue. In addition to tracking, the backport issues …dmitshur commented on html/template: iframe srcdoc attribute not properly escaped1d
As far as I can tell, this wasn't intended to be added the Go1.26.5 milestone since it has no CherryPickCandidate label nor "[1.26 backport]" suffix in title, and it doesn't seem to fixed at tip yet.…This Week
dmitshur commented on text/template/parse: continue instead of return on TestLex failure1d
Thanks.dmitshur closed an issue cmd/go/internal: fix copy paste error2d
Thanks for the information. Since [CL 762500](https://go.dev/cl/762500) didn't have an issue associated, I filed #80850 for it retroactively and used it for the backport.dmitshur commented on cmd/go: pseduo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.262d
@gopherbot Please consider this for backport to Go 1.26. There's a semi-workaround available by using `CXXFLAGS` to control Fortran flags, but that can only be used if C++ flags aren't needed, and a …dmitshur fixed an issue cmd/go: pseduo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.262d
dmitshur fixed an issue cmd/go: pseudo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.262d
dmitshur opened an issue cmd/go: pseduo #cgo directive FFLAGS value mixed up with CXXFLAGS in Go 1.262d
https://pkg.go.dev/cmd/cgo#hdr-Using_cgo_with_the_go_command documents the behavior:
> CFLAGS, CPPFLAGS, CXXFLAGS, FFLAGS and LDFLAGS may be defined with pseudo #cgo directives within these comments…dmitshur commented on golang.org/x/build/cmd/watchflakes: stop posting flakes to the issue tracker2d
CC @golang/release, @cherrymui.dmitshur commented on cmd/go/internal: fix copy paste error2d
Please see https://go.dev/wiki/MinorReleases for the backport process.
We'll need more information to consider a backport request, anything that would help us understand why a backport might be warr…dmitshur closed an issue golang.org/x/crypto: cut a new release2d
dmitshur reviewed +2 on cmd/dist: build one more toolchain when GOEXPERIMENT is set2d
Thanks.
Consider requiring at least one builder that's running into this, e.g.:
```suggestion
Change-Id: I47aed66bc30fda86366042cbf8fcc32e6a6a6964
Cq-Include-Trybots: luci.golang.try:gotip-linux-am…dmitshur commented on cmd/compile: [release-branch.go1.25] fix up backport of CL 8032402d
linux-arm passed in patch set 3.
Temporary hold while release branches are frozen for https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs.dmitshur commented on cmd/compile: [release-branch.go1.26] fix up backport of CL 8032402d
linux-arm passed in patch set 2.
Temporary hold while release branches are frozen for https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs.dmitshur commented on golang.org/x/build/cmd/relui: automate security comms inputs using security metadata2d
One of the remaining enhancements here is to re-check for any updates to the release notes when sending the announcement, so that it'd pick up any improvements to the release notes that may happen. (…dmitshur commented on cmd/compile: mips/mips64, multiply/divide results spilled from HI/LO corrupted w/ big stack frames2d
It was noted at https://groups.google.com/g/golang-dev/c/jMWTCiV0aSk/m/Qo6ozI0dBQAJ:
> Any CLs that land after CL 800721 ("internal/goversion: update Version to 1.28") but target go1.27.0 must be ch…dmitshur reviewed +2 on cmd/dist: don't rebuild the toolchain with a clean cache3d
Thanks.
Thanks for checking. I asked because keeping these comments up to date will help with future maintenance of this sequence, and it seemed worth some extra attention.
This part seems out of d…dmitshur commented on golang.org/x/mobile/cmd/gomobile: Android archives use backslashes in nested asset paths on Windows3d
CC @hajimehoshi.dmitshur commented on net: BenchmarkTCP4OneShot produces bimodal results across repeated runs3d
CC @ianlancetaylor, @neild, @nicholashusin.dmitshur commented on golang.org/x/mobile/cmd/gomobile: bind does not apply source overlays consistently3d
CC @hajimehoshi.dmitshur commented on proxy.golang.org: go mod download fails with 403 Forbidden from proxy.golang.org3d
CC @golang/tools-team.dmitshur commented on net/http: ParseSetCookie fails to parse Path values accepted by Cookie.Valid3d
CC @neild, @nicholashusin.dmitshur commented on cmd/internal/quoted: Join does not preserve empty arguments3d
CC @golang/command-line.dmitshur commented on mime: FormatMediaType emits duplicate parameters for keys differing only by case3d
CC @neild.dmitshur commented on crypto/tls: could save 45 bytes on the default ClientHello when `MinVersion` is `3`3d
CC @golang/security.dmitshur commented on net/http: HTTP/2 read loop spins at 100% CPU on a StreamError cached by tls.Conn3d
CC @neild, @nicholashusin.dmitshur commented on encoding/xml: unrecognized failures3d
CC @golang/mips.dmitshur commented on golang.org/x/crypto: cut a new release3d
Yes, this month's 'Tag x/ repos' relui workflow (#48523) is running this week, and it will tag the next golang.org/x/crypto version.dmitshur fixed an issue build: build failure on gotip-linux-amd64_c4dh96-perf_vs_release [consistent failure]3d
Other than that one failure, gotip-linux-amd64_c4dh96-perf_vs_release has been green, so closing again.dmitshur commented on cmd/compile/internal/test: TestMergeLocalsIntegration failures [consistent failure]3d
CC @golang/release, @thatnealpatel.dmitshur commented on internal/stringslite: [release-branch.go1.27] fix performance regression in index3d
Go 1.27 RC 3 will be released alongside Go 1.26/1.25 minor releases with some [pre-announced](https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs) PRIVATE-track security fixes. Unfortunately, t…dmitshur commented on encoding/json/v2: [release-branch.go1.27] modify documentation3d
A temporary hold for after Go 1.27 RC 3 is out.dmitshur commented on cmd/compile: [release-branch.go1.27] do not home mul/div results in HI/LO3d
Go 1.27 RC 3 will be released alongside Go 1.26/1.25 minor releases with some [pre-announced](https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs) PRIVATE-track security fixes. Unfortunately, t…dmitshur commented on encoding/json/v2: [release-branch.go1.27] add MarshalerTo and UnmarshalerFrom examples3d
Go 1.27 RC 3 will be released alongside Go 1.26/1.25 minor releases with some [pre-announced](https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs) PRIVATE-track security fixes. This didn't make…dmitshur commented on encoding/json/v2: [release-branch.go1.27] make Deterministic doc more approachable3d
Go 1.27 RC 3 will be released alongside Go 1.26/1.25 minor releases with some [pre-announced](https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs) PRIVATE-track security fixes. This didn't make…dmitshur commented on encoding/json/jsontext: [release-branch.go1.27] clarify safety of AvailableBuffer3d
RC 3 will be released alongside 1.26/1.25 minors with some [pre-announced](https://groups.google.com/g/golang-announce/c/8tdz5l-ccTs) PRIVATE-track security fixes. This didn't make it in time, so add…dmitshur commented on simd/archsimd: generate unifier values for SVE3d
@sunny@golang.org The description of the Code-Review submit requirement says:
> At least one Code-Review+2 is required. Self review is not allowed.
"Self review is not allowed" in this context mean…dmitshur closed an issue cmd/fix: fails to make progress after printing "applied 3 of 4 fixes; 1 file updated. (Re-run the command to apply more.)"3d
This issue seems to be the same as #77482. Merging them into one.dmitshur commented on encoding/json/v2: remove detection of cyclic data structures3d
Pinging this issue since it's very late in the [Go 1.27 release cycle](https://go.dev/s/release#timeline), and this is one of the few remaining open Go 1.27 release blockers. Is there a planned time …dmitshur commented on cmd/vet: warn about copying a time.Timer value3d
I'm realizing now this is currently an open proposal. Does it still need to go through the proposal process? If so, perhaps it should be in the Proposal milestone until that's done.dmitshur commented on cmd/vet: warn about copying a time.Timer value3d
@prattmic Would you like to submit that CL now that we're early in Go 1.28 development cycle? Moving this to Go1.28 milestone, otherwise feel to update it to Backlog.dmitshur fixed an issue all: the tree is highly flaky3d
There's been work to address this and I think we're no longer in the "highly flaky" state, so closing.
In general, highly flaky tests affecting [first-class ports](https://go.dev/wiki/PortingPolicy#…dmitshur commented on runtime: add runtime/pprof goroutine labels to tracebacks3d
It looks like there's been a good amount of progress on this issue in the Go 1.27 milestone, and it's documented at http://go.dev/doc/go1.27#runtime. This issue is still open and in the Go1.27 milest…dmitshur fixed an issue testing: t.Failed() returns false during panic3d
Closing as fixed by [CL 794541](https://go.dev/cl/794541) per https://github.com/golang/go/issues/49929#issuecomment-1883911440.dmitshur commented on golang.org/x/net/idna: ToUnicode accepts Punycode labels encoding pure ASCII labels3d
> I'm reopening this issue to track updating x/net/idna for older toolchains as well.
@neild Just to confirm, there's nothing actually left to change in the Go 1.27 and newer toolchains, is that rig…dmitshur reviewed +2 on golang.org/x/mobile/cmd/gomobile: emit replace directives without a version4d
Thanks.dmitshur commented on golang.org/x/net/html: preserve attribute ordering4d
@roland@golang.org Pinging this since it seems close to submission, if that's still your plan here, and may have gotten lost. Thanks.dmitshur reviewed +2 on golang.org/x/exp/shiny/driver/x11driver: remove unused buffer map4d
Thanks.Last Week
dmitshur commented on cmd/dist: don't rebuild the toolchain with a clean cache1w
(2 comments)
s/usersn/users/
Is the block comment above still up to date?dmitshur closed a change make.bash: update default bootstrap version1w
This change has already been applied via CL 804523.dmitshur reviewed +2 on make.bash: update default bootstrap version1w
Thanks.
Since this has a tracking issue (the one mentioned in the comment below), please include it here too:
For #77341.
CL 804523 is submitted by now and it makes a similar change. I'll rebase t…Earlier
dmitshur fixed an issue golang.org/x/telemetry/godev/internal/content: TestServer_ServeHTTP//noindex/ failures2w
Fixed by [CL 567136](https://go.dev/cl/567136).dmitshur commented on cmd/fix: [release-branch.go1.27] improve strings{cut,seq} and slicesbackward modernizers2w
Thanks.dmitshur opened an issue golang.org/x/telemetry/godev/internal/content: TestServer_ServeHTTP//noindex/ fails at Go tip as of CL 7955602w
It seems this particular test relies on the exact output of http.FileServer, which changed in [CL 795560](https://go.dev/cl/795560) for issue #80208:
```
$ go test -run=^TestServer_ServeHTTP//noinde…dmitshur opened a change cmd/fix: [release-branch.go1.27] improve strings{cut,seq} and slicesbackward modernizers2w
Pull in the fixes implemented in CL 805322, CL 805520, and CL 805400.
For #80410.
For #80554.
[git-generate]
updatestd -goroot=$(pwd) -branch=internal-branch.go1.27-vendordmitshur reviewed +2 on golang.org/x/build/internal/task: upgrade dependencies after vscode-go insider minor2w
Thanks.
Optionally, might be more readable to use a named variable:
```suggestion
if minor := release.Patch == 0; !minor || !isVSCodeGoInsiderVersion(release, "") {
```
I see other similar code d…dmitshur reviewed +2 on golang.org/x/vscode-go/tools: run go fix2w
Thanks.dmitshur reviewed +2 on golang.org/x/vscode-go/go.mod: update dependencies following the v0.57.0 release2w
Thanks.
Noting that this zero version that was here previously made the replacement directive highly load-bearing; the new version makes it more optional.dmitshur reviewed +2 on golang.org/x/vscode-go/...: upgrade go directive to at least 1.25.02w
Thanks.
In general, be mindful that going from 1.21 to 1.25 will include a fair number of changes, including the scope of variables in for loops (https://go.dev/doc/go1.22#language) and others at ht…dmitshur reviewed +2 on golang.org/x/build/internal/task: add vscode-go to the go directive update2w
Thanks.
Not seeing this change.
Also, what does the 'X' in `TestSelectGoDirectiveXReposLive` refer to? Previously the 'X' in `TestSelectGolangOrgXReposLive` was a part of "golang.org/x". Now that i…dmitshur commented on golang.org/x/build/internal/task: upgrade dependencies after vscode-go insider minor2w
(1 comment)
I see, so dropping -u and switching to `work` at once indeed doesn't work - `go get work` ends up _not_ doing `go get directdependency@upgrade` at all. Consider keeping `all` and only dr…dmitshur commented on net/url: quadratic complexity in resolvePath when processing backtrack path elements [1.26 backport]2w
CC @golang/release.dmitshur commented on net/url: quadratic complexity in resolvePath when processing backtrack path elements [1.25 backport]2w
CC @golang/release.