Change-Id: Id2aa864e4549623cc6d98d95028858d41459fa63
Reviewed-on: https://go-review.googlesource.com/c/go/+/679176
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

…ch.go1.25

Merge List:

+ 2025-06-09 da0e8c4 cmd/compile: relax reshaping condition
+ 2025-06-09 7800f4f log/slog: fix level doc on handlers
+ 2025-06-07 d184f8d runtime: check for gsignal in racecall on loong64
+ 2025-06-06 0ccfbc8 os/signal: doc link to syscall.EPIPE

Change-Id: I4e3cfdb4769207ba87788da1650ed2a1f731ed86

…ch.go1.25

Merge List:

+ 2025-06-10 7fa2c73 os: disallow Root.Remove(".") on Plan 9, js, and Windows
+ 2025-06-10 281cfcf runtime: handle system goroutines later in goroutine profiling
+ 2025-06-10 4f86f22 testing/synctest, runtime: avoid panic when using linker-alloc WG from bubble
+ 2025-06-10 773701a internal/trace: pass GOTRACEBACK=crash to testprogs
+ 2025-06-10 fb0c27c os: do not follow dangling symlinks in Root when O_CREATE|O_EXCL on AIX
+ 2025-06-10 1cafdfb net/http: make the zero value of CrossOriginProtection work
+ 2025-06-10 a35701b cmd/dist: only install necessary tools when doing local test
+ 2025-06-10 a189516 runtime: don't do a direct G handoff in semrelease on systemstack
+ 2025-06-10 f18d046 all.{bash,rc}: use "../bin/go tool dist" instead of "%GOTOOLDIR%/dist" print build info
+ 2025-06-09 ee7bfbd cmd/compile/internal/ssa: fix PPC64 merging of (AND (S[RL]Dconst ...)
+ 2025-06-09 985d600 runtime: use small struct TestSynctest to ensure cleanups run
+ 2025-06-09 848a768 runtime: clarify stack traces for bubbled goroutines
+ 2025-06-09 049a5e6 runtime: return a different bubble deadlock error when main goroutine is done
+ 2025-06-09 ac16867 cmd/internal/doc: increase version of pkgsite doc command that's run

Change-Id: Iba7b2c2f06e91a39fa039c08170e6054e50de3c6

Change-Id: I2611db09afd71b4b4811d118ec8c2446de4f8d40
Reviewed-on: https://go-review.googlesource.com/c/go/+/681056
Auto-Submit: Gopher Robot <gobot@golang.org>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>

…ch.go1.25

Merge List:

+ 2025-07-01 2f653a5 crypto/tls: ensure the ECDSA curve matches the signature algorithm
+ 2025-07-01 6e95fd9 crypto/ecdsa: fix crypto/x509 godoc links
+ 2025-07-01 7755a05 Revert "crypto/internal/fips140/subtle: add assembly implementation of xorBytes for arm"
+ 2025-07-01 d168ad1 slices: update TestIssue68488 to avoid false positives
+ 2025-07-01 27ad1f5 internal/abi: fix comment on NonEmptyInterface
+ 2025-06-30 86fca3d encoding/json/jsontext: use bytes.Buffer.AvailableBuffer
+ 2025-06-30 6bd9944 encoding/json/v2: avoid escaping jsonopts.Struct
+ 2025-06-30 e46d586 cmd/compile/internal/escape: add debug hash for literal allocation optimizations
+ 2025-06-30 479b51e cmd/compile/internal/escape: stop disabling literal allocation optimizations when coverage is enabled
+ 2025-06-30 8002d28 crypto/tls: update bogo version
+ 2025-06-30 fdd7713 internal/goexperiment: fix godoc formatting
+ 2025-06-30 740857f runtime: stash allpSnapshot on the M
+ 2025-06-30 9ae38be sync: disassociate WaitGroups from bubbles on Wait
+ 2025-06-30 4731832 crypto/hmac: wrap ErrUnsupported returned by Clone
+ 2025-06-30 03ad694 runtime: update skips for TestGdbBacktrace
+ 2025-06-30 9d1cd0b iter: add missing type parameter in doc
+ 2025-06-29 acb914f cmd/doc: fix -http on Windows
+ 2025-06-27 b51f1cd runtime: remove arbitrary 5-second timeout in TestNeedmDeadlock
+ 2025-06-27 f1e6ae2 reflect: fix TypeAssert on nil interface values
+ 2025-06-27 e81c624 os: use minimal file permissions when opening parent directory in RemoveAll
+ 2025-06-27 2a22aef encoding/json: add security section to doc
+ 2025-06-27 742fda9 runtime: account for missing frame pointer in preamble
+ 2025-06-27 fdc076c net/http: fix RoundTrip context cancellation for js/wasm
+ 2025-06-27 d9d2cad encoding/json: fix typo in hotlink for jsontext.PreserveRawStrings
+ 2025-06-26 0f8ab2d cmd/link: permit a larger size BSS reference to a smaller DATA symbol
+ 2025-06-26 988a20c cmd/compile/internal/escape: evaluate any side effects when rewriting with literals
+ 2025-06-25 b5d5559 encoding/json/jsontext: remove Encoder.UnusedBuffer
+ 2025-06-25 0b4d2ea encoding/json/jsontext: rename Encoder.UnusedBuffer as Encoder.AvailableBuffer
+ 2025-06-25 f8ccda2 runtime: make explicit nil check in (*spanInlineMarkBits).init
+ 2025-06-25 f069a82 runtime: note custom GOMAXPROCS even if value doesn't change
+ 2025-06-24 e515ef8 context: fix typo in context_test.go
+ 2025-06-24 47b941f cmd/link: add one more linkname to the blocklist
+ 2025-06-24 34cf5f6 go/types: add test for interface method field type
+ 2025-06-24 6e618cd encoding/json: use zstd compressed testdata
+ 2025-06-24 fcb9850 net/http: reduce allocs in CrossOriginProtection.Check
+ 2025-06-24 11f11f2 encoding/json/v2: support ISO 8601 durations
+ 2025-06-24 62deaf4 doc: fix links to runtime Environment Variables
+ 2025-06-24 2e9bb62 encoding/json/v2: reject unquoted dash as a JSON field name
+ 2025-06-23 ed78157 encoding/json/v2: report error on time.Duration without explicit format
+ 2025-06-23 f866958 cmd/dist: test encoding/json/... with GOEXPERIMENT=jsonv2
+ 2025-06-23 f77a0aa internal/trace: improve gc-stress test
+ 2025-06-23 4506796 encoding/json/jsontext: consistently use JSON terminology
+ 2025-06-23 456a90a runtime: add missing unlock in sysReserveAlignedSbrk
+ 2025-06-23 1cf6386 Revert "go/types, types2: don't register interface methods in Info.Types map"
+ 2025-06-20 49cdf0c testing, testing/synctest: handle T.Helper in synctest bubbles
+ 2025-06-20 3bf1eec runtime: fix struct comment
+ 2025-06-20 8ed23a2 crypto/cipher: fix link to crypto/aes
+ 2025-06-20 ef60769 go/doc: add a golden test that reproduces #62640
+ 2025-06-18 8552bcf cmd/go/internal/fips140: ignore GOEXPERIMENT on error
+ 2025-06-18 4c75672 runtime: set mspan limit field early and eagerly
+ 2025-06-18 c6ac736 runtime: prevent mutual deadlock between GC stopTheWorld and suspendG
+ 2025-06-17 53af292 encoding/json/jsontext: fix spelling error
+ 2025-06-16 d058254 cmd/dist: always include variant in package names
+ 2025-06-16 3254c2b internal/reflectlite: fix comment about meaning of flag field
+ 2025-06-16 816199e runtime: don't let readTrace spin on trace.shutdown
+ 2025-06-16 ea00461 internal/trace: make Value follow reflect conventions
+ 2025-06-13 96a6e14 runtime: comment that some linknames are used by runtime/trace
+ 2025-06-13 6449058 runtime: remove unused unique.runtime_blockUntilEmptyFinalizerQueue
+ 2025-06-13 683810a cmd/link: block new standard library linknames
+ 2025-06-12 9149876 all: replace a few user-visible mentions of golang.org and godoc.org
+ 2025-06-12 934d5f2 internal/trace: end test programs with SIGQUIT
+ 2025-06-12 5a08865 net: remove some BUG entries
+ 2025-06-11 d166a0b encoding/json/jsontext, encoding/json/v2: document experimental nature
+ 2025-06-11 d4c6eff cmd/compile: add up-to-date test for generated files

Change-Id: I555d5d1bf8c8607fa0660146019657f4c04084e3

…ne module

Removes the somewhat redundant vcs.FromDir, "allowNesting" argument,
which was always enabled, and disallow multiple VCS metadata folders
being present in a single directory. This makes VCS injection attacks
much more difficult.

Also adds a GODEBUG, allowmultiplevcs, which re-enables this behavior.

Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for
reporting this issue.

Fixes #74380
Fixes CVE-2025-4674

Change-Id: I95b619588ecb6661770aa4e1d6023d6cb22e2263
Reviewed-on: https://go-review.googlesource.com/c/go/+/686338
Reviewed-by: David Chase <drchase@google.com>
Auto-Submit: Carlos Amedee <carlos@golang.org>
TryBot-Bypass: Carlos Amedee <carlos@golang.org>

Change-Id: Iaf3a30e4c794c3f58abf429000d41f1c4f2fede1
Reviewed-on: https://go-review.googlesource.com/c/go/+/686456
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>

…ch.go1.25

Merge List:

+ 2025-07-23 489868f cmd/link: scope test to linux & net.sendFile
+ 2025-07-22 71c2bf5 cmd/compile: fix loclist for heap return vars without optimizations
+ 2025-07-22 c74399e net: correct comment for ListenConfig.ListenPacket
+ 2025-07-22 4ed9943 all: go fmt
+ 2025-07-22 1aaf742 cmd/internal/objabi: remove redundant word in comment
+ 2025-07-21 d5ec081 runtime: relax TestMemoryLimitNoGCPercent a bit
+ 2025-07-21 f7cc61e cmd/compile: for arm64 epilog, do SP increment with a single instruction
+ 2025-07-21 5dac423 runtime: fix asan wrapper for riscv64
+ 2025-07-21 e5502e0 cmd/go: check subcommand properties
+ 2025-07-19 2363897 cmd/internal/obj: enable got pcrel itype in fips140 for riscv64
+ 2025-07-19 e32255f cmd/compile/internal/ssa: restrict architectures for TestDebugLines_74576
+ 2025-07-18 0451816 os: revert the use of AddCleanup to close files and roots
+ 2025-07-18 34b7068 go/types: infer correct type for y in append(bytes, y...)
+ 2025-07-17 6653624 cmd/compile/internal/escape: improve DWARF .debug_line numbering for literal rewriting optimizations
+ 2025-07-16 385000b runtime: fix idle time double-counting bug
+ 2025-07-16 f506ad2 cmd/compile/internal/escape: speed up analyzing some functions with many closures
+ 2025-07-16 9c507e7 cmd/link, runtime: on Wasm, put only function index in method table and func table
+ 2025-07-16 9782dcf runtime: use 32-bit function index on Wasm
+ 2025-07-16 c876bf9 cmd/internal/obj/wasm: use 64-bit instructions for indirect calls
+ 2025-07-15 b4309ec cmd/internal/doc: upgrade godoc pkgsite to 01b046e
+ 2025-07-15 75a19db runtime: use memclrNoHeapPointers to clear inline mark bits
+ 2025-07-15 6d4a91c runtime: only clear inline mark bits on span alloc if necessary
+ 2025-07-15 0c6296a runtime: have mergeInlineMarkBits also clear the inline mark bits
+ 2025-07-15 397d211 runtime: merge inline mark bits with gcmarkBits 8 bytes at a time
+ 2025-07-15 7dceabd runtime/maps: fix typo in group.go comment (instrinsified -> intrinsified)
+ 2025-07-15 d826bf4 os: remove useless error check
+ 2025-07-14 bb07e55 runtime: expand GOMAXPROCS documentation
+ 2025-07-14 9159cd4 encoding/json: decompose legacy options
+ 2025-07-14 c6556b8 encoding/json/v2: add security section to doc
+ 2025-07-11 6ebb5f5 runtime: gofmt after CL 643897 and CL 662455
+ 2025-07-11 1e48ca7 encoding/json: remove legacy option to EscapeInvalidUTF8
+ 2025-07-11 a0a99cb encoding/json/v2: report wrapped io.ErrUnexpectedEOF
+ 2025-07-11 9d04122 crypto/rsa: drop contradictory promise to keep PublicKey modulus secret
+ 2025-07-11 1ca2368 crypto/rsa: fix documentation formatting
+ 2025-07-11 4bc3373 runtime: turn off large memmove tests under asan/msan
+ 2025-07-11 88cf0c5 cmd/link: do size fixups after symbol references are loaded
+ 2025-07-10 7a38975 os: trivial comment fix
+ 2025-07-10 aa5de9e synctest: fix comments for time.Now() in synctests
+ 2025-07-10 63ec70d crypto/cipher: Fix comment punctuation
+ 2025-07-09 8131635 runtime: run TestSignalDuringExec in its own process group
+ 2025-07-09 67c1704 crypto/tls: empty server_name conf. ext. from server
+ 2025-07-08 54c9d77 cmd/go: disable support for multiple vcs in one module
+ 2025-07-08 fca43a8 internal: make struct comment match struct name
+ 2025-07-08 bb917bb cmd/compile: document that nosplit directive is unsafe
+ 2025-07-08 a5bda58 cmd/compile: run fmt on ssa
+ 2025-07-07 86b5ba7 internal/trace: only test for sync preemption if async preemption is off
+ 2025-07-07 ef46e1b cmd/internal/doc: fix GOROOT skew and path joining bugs
+ 2025-07-07 75b43f9 runtime: make traceStack testable and add a benchmark
+ 2025-07-07 20978f4 crypto/rsa: remove another forgotten note to future self
+ 2025-07-07 33fb481 cmd/compile/internal/ssa: skip EndSequence entries in TestStmtLines
+ 2025-07-07 a995269 sort: clarify Less doc
+ 2025-07-03 6c3b5a2 runtime: correct vdsoSP on S390X
+ 2025-07-03 dd687c3 hash: document that Clone may only return ErrUnsupported or a nil error
+ 2025-07-02 b325151 cmd/cgo/internal/testsanitizers: skip asan tests when FIPS140 mode is on
+ 2025-07-02 15d9fe4 testing/synctest: explicitly state Run will be removed in Go 1.26
+ 2025-07-01 de646d9 cmd/go/internal/modindex: apply changes in CL 502615 to modindex package

Change-Id: I0420eec24c176a76a0ae51ddf6e34ee3fe4ae8ba

… tool -n

If we're running go tool -n always return the cached path of the tool.
We can't always use the cached path when running the tool because if we
copied the tool to the cached location in the same process and then try
to run it we'll run into #22315, producing spurious ETXTBSYs.

Fixes #72824

Change-Id: I81f23773b9028f955ccc97453627ae4f2573814b
Reviewed-on: https://go-review.googlesource.com/c/go/+/688895
Auto-Submit: Michael Matloob <matloob@golang.org>
Reviewed-by: Michael Matloob <matloob@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit efc37e9)
Reviewed-on: https://go-review.googlesource.com/c/go/+/690895
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

…ccount

TestImpersonated and TestGroupIdsTestUser are flaky due to sporadic
failures when creating the test user account when running the tests
from different processes at the same time.

This flakiness can be fixed by using a random name for the test user
account.

Fixes #73523
Fixes #74727
Fixes #74728
Fixes #74729
Fixes #74745
Fixes #74751

Cq-Include-Trybots: luci.golang.try:go1.25-windows-amd64-longtest
Change-Id: Ib2283a888437420502b1c11d876c975f5af4bc03
Reviewed-on: https://go-review.googlesource.com/c/go/+/690175
Auto-Submit: Quim Muntal <quimmuntal@gmail.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
(cherry picked from commit 374e3be)
Reviewed-on: https://go-review.googlesource.com/c/go/+/690555
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Quim Muntal <quimmuntal@gmail.com>
Reviewed-by: Mark Freeman <mark@golang.org>

…nd ".." in LookPath

Fix incorrect expansion of "" and "." when $PATH contains an executable
file or, on Windows, a parent directory of a %PATH% element contains an
file with the same name as the %PATH% element but with one of the
%PATHEXT% extension (ex: C:\utils\bin is in PATH, and C:\utils\bin.exe
exists).

Fix incorrect expansion of ".." when $PATH contains an element which is
an the concatenation of the path to an executable file (or on Windows
a path that can be expanded to an executable by appending a %PATHEXT%
extension), a path separator and a name.

"", "." and ".." are now rejected early with ErrNotFound.

Fixes CVE-2025-47906
Fixes #74466

Change-Id: Ie50cc0a660fce8fbdc952a7f2e05c36062dcb50e
Reviewed-on: https://go-review.googlesource.com/c/go/+/685755
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit e0b07dc)
Reviewed-on: https://go-review.googlesource.com/c/go/+/691775
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>