Thanks.
In contrast to issue #74739, godebug directives can only be maintained by the low-level go mod edit commands, not something higher level like go get, and we don't want the low-level go mod e…
This is a minor friction report and a suggested feature request to address it, similar to #74739, except it's about the `godebug` directive and its default key.
Consider a module with a `go 1.25.0` …
Ok, I got through everything and left inline comments.
A few high level observations are that perhaps `go fix` shouldn't try to work on packages that are marked as deprecated, or within symbols that…
This issue seems to be affecting windows/386 and windows/amd64 builders, not only gomote. It's pretty visible on the post-submit dashboard and started recently:
<img width="104" height="1147" alt="I…
Sometimes a WIP CL becomes ready for review, and it's convenient to be
able to use git-codereview to mark it as ready for review while also
possibly starting trybots and adding reviewers, without nee…
(1 comment)
To clarify, I think the follow up simplifications are fine to defer. I only mentioned them because I think splitting into multiple CLs would make it easier to pursue them in follow up CL…
Thanks for doing this.
I'm still reviewing it, leaving some early comments.
I was able to reproduce this diff with `go fix -slicesbackward=false`, other than the `var a3 [3]int` line in encoding/go…
api check implements its own [logic](https://cs.opensource.google/go/go/+/master:src/cmd/api/main_test.go;l=1155-1163;drc=87fe5fafbacac634646e8177c9df07a6805cf2d0) to detect whether an exported API s…
@prattmic pointed out a deviation in deprecation comment detection between cmd/api check and pkgsite. As is, api check considers the go/importer.ForCompiler function as deprecated, but pkgsite [does …
This is like CL 767543, but for a similar test in x/mod/zip.
It's a bit more involved because golang.org/x/mod/zip needs to support
Go 1.26 and 1.25, too. Use the //go:build-constraint syntax to enc…
Thanks.
It seems this comment ends abruptly.
I understand `ts.Listener.Addr().String()` is used here because `ts.URL` doesn't quite apply here; you want to leave out its "http://" prefix and only i…
The inclusion of 'godebug default=go1.26.2' in go.mod lets this module
keep using GODEBUG default settings from Go 1.26.2, as it did prior to
CL 771620 being submitted. It also means that while insid…
Use a fairly simple template, similar to the one we used during last
month's Go release. (If we want more creative control over these, it
could be a new field added to security metadata.)
Being shor…
The Go project doesn't use private CLs. (When something like that is needed, e.g., for developing private-track security fixes, we use a separate Gerrit host that's configured to be private at the ho…
Thanks.
Since they're environment variables rather than flags, older git versions will ignore them meaning the older git versions won't benefit from the improved test isolation, but that's fine. Go …
(1 comment)
No, unfortunately the term "milestone" ends up being ambiguous.
Maybe a reasonable way to describe this (without going too much into internals) is to say this is the "security-metadata …
Start with the "two minor releases" relui workflow, the most common one.
For now, the secuity comms are fetched at the start of the workflow,
which is very similar to what happened when these were m…
The security metadata (issue #76157) includes prepared security comms. This issue tracks using that instead of manually entering them at the start of the relui workflow (one release note entry per se…
Thanks.
Since issue #78346 will be reopened, maybe include `TODO(go.dev/issue/78346)` here so it's a bit easier to get to the tracking issue. (It can probably be found via git blame -> commit messag…
(1 comment)
Given it can be kept opaque, that seems like a good direction to go with. I see you've updated testdata for the new `ID` field name in CL 771601.
Thanks. Two questions about fields that stood out to me, but I expect you're more familiar with what they're intended to be.
Is `ID` right here? I expect it might've intended to be BuganizerID / `bu…
(2 comments)
Filed issue #79001 for it.
These updates are reasonable but a slight preference to break them out into a separate CL, since it's pretty unrelated. Sent you CL 771740.
golang.org/x/vulndb happens to use newer versions of some of the same
dependencies that golang.org/x/build has. Update to the same versions.
[git-generate]
go get golang.org/x/vulndb
go get go@1.25.…
The Go 1.25 builders that test with GOTOOLCHAIN=local produce no useful
signal since the x/vulndb module had 1.26.0 become its minimum required
language version in CL 747200. Stop these builders for …
Thanks. If that govulncheck test is the main reason this module ended up requiring as high of a language version as 1.26.2, it seems worthwhile to factor that out. Opened a tracking issue #79001 for …
The golang.org/x/vulndb module has some packages that we want to import from other golang.org/x modules, but that would propagate its current go directive 1.26.2, which is quite high. It'd be good to…
There's nothing in this module that requires 1.26.2 language semantics.
Lower its requirement to go 1.25.0 to make it possible for other modules
to depend on this module without in turn raising their…
(1 comment)
It seems this CL updates the Go toolchain version used during the build and deploy (in cmd/worker/Dockerfile and deploy/build.yaml), but also raises the minimum go language version for t…
(1 comment)
It's because a requirement on the golang.org/x/vulndb module is added, and that module requires 1.26.2:
https://cs.opensource.google/go/x/vulndb/+/master:go.mod;l=3;drc=5571712294b453fa…
(1 comment)
It seems both of these are considered valid alternative spellings of the same word, and we generally want to avoid changing spelling if it's not a fix or a clear improvement. But in this…
Thanks. This seems okay and safe to me, but it would be good if you give some time before submitting so @matloob@golang.org has a chance to look and comment if there are concerns.
The rest of the te…
That is a reasonable extension to consider. After all, the same reasoning can be applied to any VCS the go command invokes (git, hg, svn, and so on): having a go command-specific user agent helps wit…
We continue to use gitmirror for its primary mirroring functionality,
but its secondary serving functionality has not been used in a while.
With LUCI builders, we're relying on having them fetch dire…
In 2026, GitHub added support to disable comments on individual commits via the UI:
https://github.blog/changelog/2026-03-25-disable-comments-on-individual-commits/
So we're able to accomplish this…
In 2026, GitHub added support to disable comments on individual commits via the UI:
https://github.blog/changelog/2026-03-25-disable-comments-on-individual-commits/
So we're able to accomplish this…
The vcweb/vctest package sets up an HTTP+HTTPS server for go command testing needs (e.g., [here](https://cs.opensource.google/go/go/+/go1.26.2:src/cmd/go/internal/vcweb/vcstest/vcstest.go;l=64) and […
This probably needs a test, right? Otherwise this change might accidentally regress during a refactor without any test catching it.
```suggestion
go.dev/issue/35699 was a declined proposal to add th…
The default user agent in the net/http package also deliberately doesn't include the toolchain version. E.g., see comment [here](https://cs.opensource.google/go/go/+/master:src/net/http/request.go;l=…
(1 comment)
As written, this'll be willing to run any test whose name happens to contain the substring TestGenerateCertificates, but I think the intention is to run a single specific test (below). C…
@Jorropo Can you please clarify why you requested this backport to Go 1.26 and not 1.25? Is this a regression from 1.25 or is there another reason? Thanks.
I see it connected at https://chromium-swarm.appspot.com/botlist?f=cipd_platform%3Awindows-arm64&f=pool%3Aluci.golang.shared-workers and it's started its first build at https://ci.chromium.org/b/8683…
Here's the certificate for it: [windows-arm64-azure-qmuntal-1776787311.cert.txt](https://github.com/user-attachments/files/26939453/windows-arm64-azure-qmuntal-1776787311.cert.txt).
Okay, thanks for checking. I've updated our internal config ([crrev.com/i/9223085](https://crrev.com/i/9223085)) to drop the "--01" suffix from the bot matching, can you try again now?
Either it sho…