)]}'
{
  "log": [
    {
      "commit": "3de643db506517b3e652a13cc0b56034cea6b8e6",
      "tree": "a2e207190d06aac565398bdbe5d91da3b2a25955",
      "parents": [
        "05c76ee9adc59087cf3ba77ee9c8fcfab61bf61c"
      ],
      "author": {
        "name": "Ian Alexander",
        "email": "jitsu@google.com",
        "time": "Wed Oct 14 11:59:52 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Oct 27 12:00:16 2026 -0700"
      },
      "message": "html: check all ancestor namespace transitions when rendering raw text\n\nIn childTextNodesAreLiteral, walking up the tree previously stopped at\nthe nearest foreign ancestor once an HTML integration point was found.\nHowever, that integration point may itself be a descendant of an element\nthat was foster-parented into a foreign namespace (such as \u003cmglyph\u003e or\n\u003cmalignmark\u003e fostered under \u003cmtext\u003e), causing a parser to resolve the\nsubtree in a different foreign namespace upon re-parsing the rendered\noutput.\n\nContinue walking the full ancestor chain and verify that every\ntransition from a non-empty namespace occurs at an HTML integration\npoint before emitting literal text.\n\nThanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276)\nfor reporting this issue.\n\nFixes CVE-2026-97045\nFor golang/go#82622\n\nChange-Id: I67d0006dce9023451905d8e96c4d1f3d05e769cc\nReviewed-on: https://go-internal-review.googlesource.com/c/net/+/6360\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/net/+/855121\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n"
    },
    {
      "commit": "05c76ee9adc59087cf3ba77ee9c8fcfab61bf61c",
      "tree": "5f13f7f448395c24fce0ee734d43ffc0b4f81452",
      "parents": [
        "dad306f6eaa626e54daff798f071beb185e1ea2b"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Oct 22 09:50:08 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Oct 22 15:52:59 2026 -0700"
      },
      "message": "ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter\n\nReturn 0, nil from ReadBatch and WriteBatch when ms is empty on non-Linux\nplatforms (matching the Linux behavior), and return an error from SetBPF\nwhen the filter slice is empty or exceeds MaxUint16 instructions.\n\nChange-Id: I8863524004aad5a6bc5f967f02e529866a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/852829\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "dad306f6eaa626e54daff798f071beb185e1ea2b",
      "tree": "87febf279130f02be4c608e6a43d4b5dec0d98c6",
      "parents": [
        "9c0565ad2c29e4eefb9a4db789a0b6b3b95cbb29"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Oct 22 09:48:45 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Oct 22 15:52:54 2026 -0700"
      },
      "message": "ipv6: avoid out-of-bounds panic in ICMPFilter\n\nCheck that ICMPType is in range [0, 255] before indexing the 8-element\nfilter array in ICMPFilter.Accept, Block, and WillBlock.\n\nChange-Id: I39f17e80aff45b2cef9c6aeb2bb84c0c6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/852828\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "9c0565ad2c29e4eefb9a4db789a0b6b3b95cbb29",
      "tree": "ffa82775b1f16611009d66bcd898c25897147028",
      "parents": [
        "9425eb39b361fa333359608bb730c80cb79fc062"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Oct 22 09:47:42 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Oct 22 15:52:50 2026 -0700"
      },
      "message": "ipv4: fix TTL control message parsing on big-endian Linux and Solaris\n\nOn Linux, IP_TTL ancillary data is a 4-byte native-endian int rather than\na 1-byte value; reading only the first byte misparsed the TTL as 0 on\nbig-endian architectures. On Solaris, IP_RECVTTL ancillary data is a\n1-byte uint8_t, not 4 bytes.\n\nChange-Id: I3ccebc693bc3aa377890bc4ebc8e7cc66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/852827\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "9425eb39b361fa333359608bb730c80cb79fc062",
      "tree": "9762f80554e822d101bdd9b9a6b079113c68dd95",
      "parents": [
        "4b10404ac8ce5678eb26efd39b7c26901c1fd3da"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Oct 22 09:46:10 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Oct 22 15:52:46 2026 -0700"
      },
      "message": "internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix\n\nOn platforms without cmsghdr support (such as Windows), controlHeaderLen\nreturns 0. Guard against controlHeaderLen() \u003c\u003d 0 in ControlMessage\nmethods so parsing or marshaling an empty buffer does not index \u0026m[0]\nand panic.\n\nChange-Id: I16f8bc821b92a015af4ef9711e7378206a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/852826\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "4b10404ac8ce5678eb26efd39b7c26901c1fd3da",
      "tree": "9dfe0d4085137abf4ccb5822a3870d09d39765d9",
      "parents": [
        "afcf8cd5baa866e7d60a71e229cd61cf2108e043"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Oct 22 09:45:18 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Oct 22 15:52:42 2026 -0700"
      },
      "message": "ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse\n\nCheck that ctlOpts entries are populated (name \u003e 0) before matching\nagainst the control message type in ControlMessage.Parse. Previously,\na control message with type 0 could match an unpopulated ctlOpts entry\nand panic calling a nil parse function.\n\nChange-Id: I9f4b2b419ada6ad76f4a294716dc8ad06a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/852825\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "afcf8cd5baa866e7d60a71e229cd61cf2108e043",
      "tree": "aa325e1a207b64a6552beddfe39d481b1d061479",
      "parents": [
        "4af4fce62e93c5621a316363718b9dc78fbb0355"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Oct 21 14:12:54 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Oct 22 15:52:38 2026 -0700"
      },
      "message": "ipv4: fix several missing bounds checks\n\nChange-Id: Ib22edd9e8f5755a788944895a1c7d3ec6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/852745\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Ian Lance Taylor \u003ciant@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "4af4fce62e93c5621a316363718b9dc78fbb0355",
      "tree": "ce9357271761c4d91cadb8ea4f1e736f25e342ca",
      "parents": [
        "7e562009b3884a0845019b5f886f0242a7c0b970"
      ],
      "author": {
        "name": "Ian Alexander",
        "email": "jitsu@google.com",
        "time": "Wed Oct 14 16:28:56 2026 -0400"
      },
      "committer": {
        "name": "Ian Alexander",
        "email": "jitsu@google.com",
        "time": "Tue Oct 20 06:54:14 2026 -0700"
      },
      "message": "html: avoid quadratic complexity when coalescing text nodes\n\nWhen coalescing adjacent text nodes in addText and fosterParent,\nappending to an existing TextNode\u0027s Data via string concatenation\n(n.Data +\u003d text) reallocated and copied the accumulated string on every\ntoken. Inputs containing many short text runs separated by ignored end\ntags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and\nmaterialize Data strings once at the end of parse.\n\nThanks to Markus Magnuson for reporting this issue.\n\nFixes CVE-2026-78661\nFixes golang/go#82224\n\nChange-Id: I4cd61a235d0cc14567e8edd3e4ce851999de7731\nReviewed-on: https://go-review.googlesource.com/c/net/+/849365\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "7e562009b3884a0845019b5f886f0242a7c0b970",
      "tree": "632acd6a3bb9b3c31f2081fd3b14a4e7bb4cd959",
      "parents": [
        "c1d31df183e51b1075a2fd670d6f6f4efb871773"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 10 22:59:15 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Oct 13 08:59:13 2026 -0700"
      },
      "message": "quic: per-path connection ids\n\nAssociate a path with each remote (destination) connection ID.\nA connection ID should be strictly used on only one network path,\nto reduce an attacker\u0027s ability to associate packets sent on\nvarying paths.\n\nDCID (destination connection ID) selection now uses the current path\nas an input.\n\nPeer-provided connection ID limit changed to 4, which is in line\nwith other implementations. (Lots of variation, 4 is median-ish.)\n\nChange-Id: Ic34592c60b9f846e923c604bc0c77c826a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/832367\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "c1d31df183e51b1075a2fd670d6f6f4efb871773",
      "tree": "5e1c5e6d2c447c093611fc328c757826b33a91bb",
      "parents": [
        "8456a207cc33a21300bb8964ed756e5b681aeeeb"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Oct 09 09:43:37 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Oct 09 10:07:24 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: If887708303e22608b91fb2f30e560899495edbb4\nReviewed-on: https://go-review.googlesource.com/c/net/+/847787\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "8456a207cc33a21300bb8964ed756e5b681aeeeb",
      "tree": "897f290666478df3c7dc63f67c64c5ce262c1d8e",
      "parents": [
        "18ece0ce30bc35fa81fe72028bf309bb3ff3f4a5"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Sep 25 11:54:15 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Oct 08 16:44:16 2026 -0700"
      },
      "message": "quic: properly check for allowed frame types in a packet\n\nFrame check assumed packetTypes are usable in a bitmask,\nbut they were a sequential enumeration.\n\nChange-Id: Ibf2541b922222de46f0d24b8dc77f90c6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/839025\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "18ece0ce30bc35fa81fe72028bf309bb3ff3f4a5",
      "tree": "66f4332cb51dd5ffb3fece4676b8a974127d8488",
      "parents": [
        "2d03f9dcd22da1be6f645ddfd0541fd94d68e5db"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed Sep 30 10:52:25 2026 -0400"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Thu Oct 08 10:22:58 2026 -0700"
      },
      "message": "http2: prevent crash due to HPACK encoder race\n\nThis is a backport CL for the equivalent change in std.\n\nFixes CVE-2026-97032\nFixes golang/go#81867\n\nChange-Id: I8eaacd659f5d357b32699b63f726c4356a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/847188\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "2d03f9dcd22da1be6f645ddfd0541fd94d68e5db",
      "tree": "62df9885e26c222db515e4d2ab44842c71a7acaf",
      "parents": [
        "cc7d34fd2dd5864bcafe3e5e0a84919240be98c0"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Sep 29 14:22:16 2026 -0700"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Thu Oct 08 10:22:51 2026 -0700"
      },
      "message": "http2: avoid 2x refund on stream close with buffered data\n\nFix the following bug:\n\n  - client opens a stream and sends data\n  - client resets the stream, and server refunds flow control\n  - handler reads the sent data, and server refunds flow control again\n\nThis double-refund allows a malicious client to exceed the server\u0027s\nflow control limits, potentially causing the server to buffer much\nmore data than those limits should allow.\n\nThanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)\nfor reporting this issue.\n\nFixes CVE-2026-78663\nFor #81743\n\nChange-Id: If55e681836d20c64e908ae827b2990a66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/847187\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "cc7d34fd2dd5864bcafe3e5e0a84919240be98c0",
      "tree": "93be3dca3fcfbda8bc53a156e648750e55396792",
      "parents": [
        "57f4235f83712a299328015548240512213a3852"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Sep 30 14:14:18 2026 -0700"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Thu Oct 08 10:22:43 2026 -0700"
      },
      "message": "http2: avoid excessive work on initial window changes\n\nThis is the backport of the equivalent fix in std.\n\nDefend against a malicious peer sending many adjustments to the initial\nflow control window.\n\nThe flow control window for a stream is:\n  initial_window + sum(window_updates) - sum(bytes_sent)\n\nThe initial window starts at 64k, but may be adjusted at any time\nby a SETTINGS frame.\n\nA decrease in the initial window might cause a stream\u0027s current\nwindow to become negative, which is fine.  (This happens when a\nstream has already consumed some portion of its existing window.)\n\nAn increase in the initial window MUST NOT cause the window of\nany stream to exceed the maximum of (2^31-1). RFC 9113 requires\nus to check for this:\n\n\tAn endpoint MUST treat a change to SETTINGS_INITIAL_WINDOW_SIZE\n\tthat causes any flow-control window to exceed the maximum size as\n\ta connection error (Section 5.4.1) of type FLOW_CONTROL_ERROR.\n\nWe enforced this by iterating over every active stream to adjust its\nwindow and verify that the new window is not too large. While iterating\nover streams is O(N), a malicious peer could send many small SETTINGS frames\nand cause a large amount of CPU consumption when the number of open\nstreams is high.\n\nThe new implementation enforces the window less strictly, but performs\nO(1) work in response to a change in the initial window.\nIndividual streams now maintain a delta from the initial window:\n\n  delta \u003d sum(window_updates) - sum(bytes_sent)\n\nThe current stream window is computed on-demand by adding the\ncurrent initial window to the delta.\n\nOverflow is detected lazily, when trying to write data for a stream\nor when processing a WINDOW_UPDATE. This is technically speaking\na violation of RFC 9113\u0027s requirements, but it\u0027s a harmless one\nand ensures we never do excessive work in reaction to a change\nin the initial window.\n\nAlternatives considered:\n\n- Maintain a heap of streams, sorted by current window size.\n  Too complicated. Too much overhead. The juice is not worth the squeeze.\n\n- Maintain a high-water mark for the stream delta, and only do an O(N)\n  iteration over all streams when the high-water mark indicates that\n  overflow might have happened. Avoids expensive processing in most\n  cases, but is vulnerable to a peer sending a rapid sequence of:\n\n    create stream\n    update stream window (updating the high-water mark)\n    reset stream\n    increase initial window to cause iteration (no violation)\n    decrease initial window\n\n  This scenario is more work than just a sequence of changes to the\n  initial window, and there are possibly ways to defend against it,\n  but lazy overflow detection is simpler and extremely robust.\n\nThanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.\n\nFixes CVE-2026-78669\nFor #81903\nFor #81742\n\nChange-Id: I85cae817fed6d972af274646abec88616a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/847186\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "57f4235f83712a299328015548240512213a3852",
      "tree": "cb0d67b48b62868301f5b53da270210eed951bbf",
      "parents": [
        "01e3d0338c2256320c59c863f9298e9544a99feb"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed Sep 30 11:03:43 2026 -0400"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Thu Oct 08 10:22:35 2026 -0700"
      },
      "message": "http2: apply header limits to Trailer headers too\n\nThis is a backport CL for the equivalent change in std.\n\nFixes CVE-2026-78659\nFixes golang/go#81857\n\nChange-Id: I84e19d6a2aa201223c7d89eb2e8c1b576a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/847185\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "01e3d0338c2256320c59c863f9298e9544a99feb",
      "tree": "b1dea12a36891aaa004919571fcd6f6e070a966d",
      "parents": [
        "28247830e9fb37184c6be718f483a0c7d0949022"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 24 12:47:35 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Oct 06 12:19:56 2026 -0700"
      },
      "message": "http2: coalesce dials via wrapped Transport.RoundTrip\n\nThe http2.Transport has historically coalesced dials for requests\nsent via its RoundTrip (as opposed to via net/http). The wrapping\nimplementation inadvertently removed dial coalescing. Add it back.\n\nFixes golang/go#81646\n\nChange-Id: Ib174d16f7cd9508efb0eca470d4dbf266a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/845005\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "28247830e9fb37184c6be718f483a0c7d0949022",
      "tree": "6b6f9feebda90d7be0f6c07a8a253218fc6fdcd0",
      "parents": [
        "b13c0c165994a0042e0c4a4d01e2b998097967c9"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Sep 21 16:15:43 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Sep 28 13:10:06 2026 -0700"
      },
      "message": "http2: delete malformed framing-related headers\n\nThis is the x/net backport of CL 835145.\n\nFor golang/go#81115\nFixes CVE-2026-78660\n\nChange-Id: If80199a7b1cbbc418f1ea34973d5e08a6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/836385\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b13c0c165994a0042e0c4a4d01e2b998097967c9",
      "tree": "4d03ab55882a3d49427d473f25b35f9cf28b36b6",
      "parents": [
        "520c891fe60b2ffd4b4ee349d95cac4c1c0d9ee1"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 18 17:58:21 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Sep 21 13:34:53 2026 -0700"
      },
      "message": "internal/http3: delete HTTP/3 package\n\nThe HTTP/3 implementation has been moved to net/http/internal/http3 in\nstd. Delete the x/net implementation.\n\nFor golang/go#70914\n\nChange-Id: Ia2fddc04990472479cc36d5ac34b27ef6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/836345\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "520c891fe60b2ffd4b4ee349d95cac4c1c0d9ee1",
      "tree": "ab643654266d93e39c6362e9b7b0771dbd7c9c25",
      "parents": [
        "656874fd46a65a97eac94003e0eb8751be4403d0"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 10 19:19:17 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Sep 18 15:36:59 2026 -0700"
      },
      "message": "quic: off-path support in loss/congestion/rtt\n\nPackets sent on one path must not affect congestion control and \nRTT estimates for other paths. Add support for distinguishing\nbetween on-path packets sent on the currently active path,\nand off-path packets sent on any other path.\n\nProbing packets can be sent off-path to validate a path.\n\nAfter address migration, all packets sent on the previous\npath become off-path.\n\nChange-Id: I345e785343c6b982cb0d4157bf77d7fb6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/832366\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "656874fd46a65a97eac94003e0eb8751be4403d0",
      "tree": "147ea8b2ac833cab675c871db2140b2052eab3b4",
      "parents": [
        "a818e160ee8fbf01b12286ff806fab82f0ed764f"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 10 16:03:26 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 15 13:55:17 2026 -0700"
      },
      "message": "quic: determine local address for connections\n\nProperly handling path migration requires QUIC connections to know\nboth the address they are sending from and the address they are\nsending to.\n\nDetermine the local address for a path by creating a temporary UDP\nsocket bound to the path; this sends no packets but lets us see\nwhat address the kernel thinks should be used on the path.\n(When using a non-*net.UDPConn connection, we don\u0027t attempt to do\nthis on the theory that our PacketConn likely doesn\u0027t use the real\nnetwork.)\n\nUpdate fake-network tests to use valid source/destination addresses\nfor all datagrams.\n\nChange-Id: Ia89f7daf479b10df4c1d23f3e64ad3726a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/832365\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "a818e160ee8fbf01b12286ff806fab82f0ed764f",
      "tree": "2317aaf8c7bffd8f32d565e2b2c3745b7f588121",
      "parents": [
        "f557b1863b98a9c5a91f9c871c98b07cfc3558ac"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 10 15:12:35 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 15 12:47:50 2026 -0700"
      },
      "message": "quic: add a pathAddrs type, holding a local/peer address pair\n\nMost of the time we\u0027re interested in the combination of\nlocal and peer address, so make it easy to treat them\nas a set.\n\nChange-Id: I75e57fe417a7781f0c44a7121dc9ed6d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/832364\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "f557b1863b98a9c5a91f9c871c98b07cfc3558ac",
      "tree": "1df09043a9be0e6b7d355aaf9c6a24dc66e639f6",
      "parents": [
        "53e34cd8c56120ce92ef5ee7c4cd8510f57f6e8b"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 11 15:33:43 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 11 20:29:16 2026 -0700"
      },
      "message": "internal/http3, internal/httpcommon: move gzip reader implementation\n\nThis is the x/net counterpart of CL 831344.\n\nLegacy HTTP/2 implementation in x/net can technically use the shared\ngzip reader implementation too. However, since the package is frozen,\nleave it be.\n\nFor golang/go#81473\n\nChange-Id: Ia8663ecea8013abaa5c1f53dc58bdbd86a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/831364\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "53e34cd8c56120ce92ef5ee7c4cd8510f57f6e8b",
      "tree": "254277de1ec4b5b3a6f412223de02f00f250d0e8",
      "parents": [
        "540d04cfe5028e2655754591a4d3e08c586809f2"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Sep 09 16:02:02 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Sep 09 16:15:12 2026 -0700"
      },
      "message": "http2: drop benchmarks\n\nAlready don\u0027t exist on go1.27+, but panic on go1.26 due to trying to\nsynctest.Wait outside a bubble. Just delete them.\n\nFixes golang/go#81399\n\nChange-Id: I656f94e56b81a7864202a41499f779176a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/830344\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "540d04cfe5028e2655754591a4d3e08c586809f2",
      "tree": "1c082543aaddc170115860ee54204ff5d4601e28",
      "parents": [
        "20eef7fe493df0e014a996c5432e177a76987b84"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 08 11:33:30 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 08 12:18:02 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Ie0d34baf705908a88b9d224714dd4b6063987a02\nReviewed-on: https://go-review.googlesource.com/c/net/+/829344\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "20eef7fe493df0e014a996c5432e177a76987b84",
      "tree": "52157db8a28918516b56f4461d9b900130835f8b",
      "parents": [
        "c23af1b9b8cc40d792e7ffd20aa02bfb8984a1f5"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 04 13:27:46 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Sep 07 12:59:47 2026 -0700"
      },
      "message": "quic: clear fast-path receive buffer on stream reset\n\nWhen a stream is reset by the peer, unread stream data is discarded and\nits underlying memory buffers are returned to a pool for reuse. However,\nthe stream\u0027s fast-path read buffer was not cleared when the stream was\nreset, leaving a dangling reference to the recycled memory. This\nsurfaced as a data race in one of our HTTP/3 tests.\n\nTherefore, make sure that the fast-path read buffer is cleared when a\nstream is reset. Also do the same when STOP_SENDING frame is sent, where\nan equivalent bug exists.\n\nFor golang/go#70914\nFor golang/go#81349\n\nChange-Id: Ie1d75b646baa59804380feeb84ac0ff26a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/827804\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "c23af1b9b8cc40d792e7ffd20aa02bfb8984a1f5",
      "tree": "203dec29735ec684a1fdedf337879c6ac3a6b4fc",
      "parents": [
        "eda109f56e86afc41ee941c810e5e4e49f901ec3"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 04 16:07:49 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Sep 04 14:55:52 2026 -0700"
      },
      "message": "internal/http3: fix compilation error due to missed symbol name update\n\nCL 825004 updated quic.StreamErrorCode to quic.StreamError. However, one\nusage of quic.StreamErrorCode was not updated somehow, presumably due to\nmultiple CLs being sent and merged concurrently.\n\nChange-Id: Ifd9155aaeb186e428258a4f60a122e3e6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/827805\nAuto-Submit: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "eda109f56e86afc41ee941c810e5e4e49f901ec3",
      "tree": "b74f492f33b93dd7e32e55566c01d7cb14ed861f",
      "parents": [
        "12e0501290cb42609218b4818c97566c221de4c2"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 31 20:25:56 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Sep 01 13:50:07 2026 -0700"
      },
      "message": "internal/http3: send appropriate error codes in STOP_SENDING frames\n\nNow that the quic package supports setting an error code for\nSTOP_SENDING frames, update the HTTP/3 layer accordingly.\n\nFor golang/go#70914\n\nChange-Id: I0f439c685e4fda883dddeb92fae78ddc6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/825364\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "12e0501290cb42609218b4818c97566c221de4c2",
      "tree": "535a8fae7b9ad92dae6c02bab01ff9434a596765",
      "parents": [
        "d89285e91501dd797ddcc984ed09fc71f12c0af0"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 31 15:16:21 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Sep 01 11:28:30 2026 -0700"
      },
      "message": "internal/http3: server header size limits\n\nApply Server.MaxHeaderBytes.\n\nIncludes commented-out support for MaxHeaderValueCount.\nIt\u0027s probably not worth using build tags to make this conditional\non go 1.27, so just leave it out for the moment.\n\nChange-Id: I6452b6aba3336d48ebb877621ebecb7e6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/825264\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "d89285e91501dd797ddcc984ed09fc71f12c0af0",
      "tree": "f92a0986778cb1724d530b657f2f2ba6cf3b7ea5",
      "parents": [
        "d34deae423f98518a84a3735ab82e3e031a375fb"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 31 11:28:16 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Aug 31 15:44:11 2026 -0700"
      },
      "message": "quic: add Stream.StopSending, and rework stream/application errors\n\nRename StreamErrorCode to StreamError, to maintain the convention that\nerror type names end with \"Error\".\n\nRename ApplicationError to ConnectionCloseError, to distinguish it\nfrom StreamError.\n\nAdd a Stream.StopSending method, which is Stream.CloseRead but permits\nsetting the application error code to send.\n\nAdd an error return value to Stream.CloseRead and Stream.CloseWrite,\nto match the signature of net package methods with these names.\n\nChange-Id: Ie84b4b0b874636deae8adc9de26e90886a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/825004\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "d34deae423f98518a84a3735ab82e3e031a375fb",
      "tree": "14d0e60dcd978a40f8fabbb2c067ad33d52c93ed",
      "parents": [
        "55577aaeb84956beaf8ecbd12491a2774c33169c"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Thu Aug 27 22:50:27 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Fri Aug 28 12:28:15 2026 -0700"
      },
      "message": "quic: ensure Endpoint.Close waits for connection loops to exit\n\nIn CL 822984, Endpoint.Close was modified to only return when its listen\nloop has actually exited.\n\nHowever, if Endpoint.packetConn is closed prior to Endpoint.Close being\ncalled (as in the case of net/http), Endpoint.Close can still return\nprematurely before all connection loops exit.\n\nFix this by making sure that we also wait for all connection loops to\nexit.\n\nFor golang/go#70914\n\nChange-Id: I7dbc985475e845c89e2fa9a7755718326a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/823524\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "55577aaeb84956beaf8ecbd12491a2774c33169c",
      "tree": "ae836f7622dce1e4664b80f5875f3bdabeb3c6f2",
      "parents": [
        "b22627e5363920905c17b5e37e10d2b0329972ec"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Aug 21 11:46:14 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Aug 27 18:50:20 2026 -0700"
      },
      "message": "http2: use IDNA Lookup profile, not raw Punycode translation\n\nFor golang/go#81010\n\nChange-Id: I184386da6e62b5cc4108537f297191436a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/819201\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b22627e5363920905c17b5e37e10d2b0329972ec",
      "tree": "6e636031b31447534dc4926058de96d3bb812cb5",
      "parents": [
        "6e98b0dc709b77cf047bee24a08232937ea78bab"
      ],
      "author": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 11:26:21 2026 -0400"
      },
      "committer": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 18:28:42 2026 -0700"
      },
      "message": "internal/http3: handle a nil TLSConfig in newQUICConfig\n\nnewQUICConfig read tlsConfig.NextProtos before checking tlsConfig for nil, so\na nil tls.Config panicked. The nil check that followed, after tlsConfig.Clone(),\nwas unreachable.\n\nThis is reachable from initEndpoint, which passes http.Transport.TLSClientConfig\nstraight through, and that field is nil for a default Transport:\n\n    panic: runtime error: invalid memory address or nil pointer dereference\n        golang.org/x/net/internal/http3.newQUICConfig(...)\n        golang.org/x/net/internal/http3.(*transport).initEndpoint(...)\n\nChange-Id: I8b8dcb56a2ffc148a03894335f9d74196a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/823105\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "6e98b0dc709b77cf047bee24a08232937ea78bab",
      "tree": "b8c980b2df3218744c68f57b217c5fa43a16a202",
      "parents": [
        "980ca2df21e0ad4bf2b1f1423dcb90572b5b1029"
      ],
      "author": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 11:22:23 2026 -0400"
      },
      "committer": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 18:28:30 2026 -0700"
      },
      "message": "internal/http3: report endpoint creation errors from initEndpoint\n\nFix err shadow bug.\n\nChange-Id: Id66e8bb3d94cb9ff36c94f5bb74242b66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/823104\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "980ca2df21e0ad4bf2b1f1423dcb90572b5b1029",
      "tree": "22276d6a0a6aec1297768cb085fb0bace2eaffd0",
      "parents": [
        "54909996cab9290184de742137eaea939da894e9"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Thu Aug 27 09:43:44 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu Aug 27 12:25:20 2026 -0700"
      },
      "message": "quic: make Endpoint.Close return only when the endpoint is actually closed\n\nWhen the context passed to Endpoint.Close has been canceled, it will\ncorrectly abort any active connections immediately, without waiting for\npeer acknowledgement. However, in doing so, Endpoint.Close will\nimmediately return without waiting for its listen loop to actually exit.\nAs a result, callers such as our HTTP/3 implementation cannot know\nwhether the endpoint is actually completely closed or not, and the\nendpoint might be detected as a goroutine leak in tests.\n\nFor golang/go#70914\nFor golang/go#78701\n\nChange-Id: Idd67ae200305001be336da50f1794c716a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/822984\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "54909996cab9290184de742137eaea939da894e9",
      "tree": "bdf22f5ee95e293d8e89c6d29cd1b1ade2ba4817",
      "parents": [
        "f3ca0345eec60477f21b1c75d5772f2f19acbd73"
      ],
      "author": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 09:22:53 2026 -0400"
      },
      "committer": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 11:24:01 2026 -0700"
      },
      "message": "internal/http3: close the request body before RoundTrip returns\n\nwriteBodyAndTrailer runs in its own goroutine and closes Request.Body from a\ndeferred call, so RoundTrip could return while that close was still in\nprogress. Nothing else closed the body in that case: net/http wraps the body\nin a readTrackingBody whose Close sets didClose before calling the underlying\nClose, and Transport.roundTrip skips its own req.closeBody() once didClose is\nset. A caller inspecting the body as soon as RoundTrip returned could\ntherefore observe that it had never been closed:\n\n    client_test.go:2088: close calls \u003d 0; want 1\n    transport_test.go:4242: didn\u0027t see Body.Close\n\nWait for writeBodyAndTrailer to finish with the body before returning an\nerror, closing the body first so that a writeBodyAndTrailer blocked reading\nfrom it wakes up. The HTTP/2 transport does the same thing for the same\nreason; see golang/go#60041.\n\nClosing the body on the error path also covers the case where\nwriteBodyAndTrailer was never started, which happens when a request sends\n\"Expect: 100-continue\" and the server answers with a final status.\n\nFixes golang/go#81108.\nFixes golang/go#81148.\n\nChange-Id: Ib4d361b451a7295b1875ef5a10d4fde26a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/822944\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "f3ca0345eec60477f21b1c75d5772f2f19acbd73",
      "tree": "989af9b8e6b32c5ec7d4ad0d008fd5cea8a63323",
      "parents": [
        "a3752289cad6b778a73fa6ee9163604d0c55aec1"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Sat Aug 22 17:28:46 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 26 21:37:56 2026 -0700"
      },
      "message": "http2: deprecate Transport and Server\n\nFixes golang/go#78064\n\nChange-Id: Ia8f5c109b4594ef5a4fca1eacfc0f2da6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/819740\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "a3752289cad6b778a73fa6ee9163604d0c55aec1",
      "tree": "98c0a6e50276958d30b1912689c427c8390ccb6f",
      "parents": [
        "679e2dbb6f744eef63600214a2a1a74942837ab0"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Aug 25 20:07:50 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 26 21:18:26 2026 -0700"
      },
      "message": "internal/http3: do not abort roundtrip when server closes request stream\n\nPer RFC 9114 Section 4.1, a server might opt to ignore some part of a\nrequest if it can construct a response without the unsent part of the\nrequest.\n\nCurrently, our transport always aborts a roundtrip when we try to write\na request body to a stream that has been reset. As a result, when a\nserver returns a response early, roundtrip erroneously fails. This seems\nto be the cause of flakes in std tests, where we are failing due to\n\"writing request body: write to reset stream\".\n\nFix this issue by making sure the transport will gracefully stop writing\nwhen a server ignores its request, indicated by STOP_SENDING frame\ncontaining H3_NO_ERROR error code. In our QUIC implementation, the\nSTOP_SENDING frame currently contains error code 0 rather than\nH3_NO_ERROR due to an existing TODO. For now, also accept error code 0;\nmodifying QUIC to send H3_NO_ERROR error code will be done in a separate\nCL.\n\nFor golang/go#70914\nFor golang/go#81079\nFor golang/go#81085\nFor golang/go#81088\nFor golang/go#81094\nFor golang/go#81105\n\nChange-Id: I980f6966a41873f1a96fd93d3d3084d66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/821920\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "679e2dbb6f744eef63600214a2a1a74942837ab0",
      "tree": "15c059fa0835ed0557b35c67885a0d101022a10d",
      "parents": [
        "af341ad5e59a6b68d5ff7b0c860e3d8f7e201a9b"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 24 15:05:55 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Aug 26 21:08:42 2026 -0700"
      },
      "message": "quic: don\u0027t exceed anti-amp limit with Initial padding\n\nWhen the anti-amplification limit is less than 1200 bytes,\nwe can not send a padded Initial packet. Detect and handle this case.\n\nFixes golang/go#81082\n\nChange-Id: Ib56a6cfeca1084a0bb8d1efc79ee95946a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/820680\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "af341ad5e59a6b68d5ff7b0c860e3d8f7e201a9b",
      "tree": "2ab25aff83c9e33d9c29b797fc1b9a199f2c18cf",
      "parents": [
        "bf481657f8f2118587dddc63b9f389f2243a5358"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 26 15:15:02 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 26 14:17:44 2026 -0700"
      },
      "message": "internal/http3: do not treat 1xx status as the final response status\n\nTestServer1xxExpect100ContinueRace is flaky for HTTP/3 in std. This is\nbecause duplicate status 100 can cause the HTTP/3 transport to\naccidentally treat 100 as the final response status.\n\nMake sure that 1xx headers are always treated as informational status\nrather than the final status.\n\nFor golang/go#70914\nFor golang/go#81119\n\nChange-Id: Id834c403ae565ed00aa03ac89f69b7286a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/822544\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "bf481657f8f2118587dddc63b9f389f2243a5358",
      "tree": "08b796de226eec80a391dfaeb9cda6fb0a6935e5",
      "parents": [
        "7f141996eacac4646d12ec23d96694361a1e2600"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 24 14:57:07 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Aug 25 15:24:30 2026 -0700"
      },
      "message": "internal/http3: wait until clientConn is unregistered when closing it\n\nThe longtest in std is currently failing due to lingering goroutines at\nthe end of tests. This seems to be occurring due to CloseIdleConnections\nbeing called before the clientConn had the chance to be fully\nunregistered from the transport. This results in CloseIdleConnections\nbeing unable to close the QUIC endpoint (thinking that there are still\nactive connections).\n\nMake sure that clientConn.Close only returns after clientConn is\nunregistered from the transport to fix this.\n\nUnfortunately, this race condition seems to occur only when testing in\nstd using fakenet. Therefore, no tests in this CL for now.\n\nFor golang/go#78701\nFor golang/go#70914\n\nChange-Id: I35c66b3e843be5f53ceef602d0ac456f6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/820540\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "7f141996eacac4646d12ec23d96694361a1e2600",
      "tree": "59ac5e86b91f25ce91310f8f23410d6131168090",
      "parents": [
        "fc715e5c972bf4ec70ca609630538e6b71d6480c"
      ],
      "author": {
        "name": "Tobias Klauser",
        "email": "tklauser@distanz.ch",
        "time": "Tue Aug 25 12:04:04 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 25 07:18:31 2026 -0700"
      },
      "message": "all: use min/max builtins\n\nChange-Id: I2c9db8f6260bb5b1d745b49bcc5edbae17007851\nReviewed-on: https://go-review.googlesource.com/c/net/+/821080\nReviewed-by: Jorropo \u003cjorropo.pgm@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nAuto-Submit: Tobias Klauser \u003ctobias.klauser@gmail.com\u003e\n"
    },
    {
      "commit": "fc715e5c972bf4ec70ca609630538e6b71d6480c",
      "tree": "edd47bbee15f8956db1a90ef898bbb82d9aeb744",
      "parents": [
        "37f3d6f02f416ee4b2e752493f052ccdcd2df450"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 19 17:56:37 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 19 19:46:10 2026 -0700"
      },
      "message": "internal/http3: include minor HTTP version in default User-Agent header\n\nHTTP/1 and HTTP/2 transports include the minor version in their default\nUser-Agent header. Do so for HTTP/3 too for consistency.\n\nFor golang/go#70914\n\nChange-Id: I750bf9a21bef28594262c33349940d856a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/817121\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "37f3d6f02f416ee4b2e752493f052ccdcd2df450",
      "tree": "3735157f7515a0bcf00da7a6c965b0b8a8a235b6",
      "parents": [
        "f6c404bf8371cea2a96e5bf2075b6f5a3b06657c"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 19 16:59:34 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 19 10:26:06 2026 -0700"
      },
      "message": "all: upgrade go directive to at least 1.26.0 [generated]\n\nBy now Go 1.27.0 has been released, and Go 1.25 is no longer supported\nper the Go Release Policy (see https://go.dev/doc/devel/release#policy).\n\nSee https://go.dev/doc/godebug#go-126 for GODEBUG setting changes\nrelevant to Go 1.26.\n\nFor golang/go#69095.\n\n[git-generate]\n(cd . \u0026\u0026 go get go@1.26.0 \u0026\u0026 go mod tidy)\n\nChange-Id: I902f0e83fde8c990231c42e01e48aa7721785ed1\nReviewed-on: https://go-review.googlesource.com/c/net/+/817840\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n"
    },
    {
      "commit": "f6c404bf8371cea2a96e5bf2075b6f5a3b06657c",
      "tree": "9dddb1824bbe77f4b08bebaec503acd4139dff6b",
      "parents": [
        "c354d3f669cd33e14548d5359f52fbf842daed39"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 17 09:54:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Aug 17 11:11:09 2026 -0700"
      },
      "message": "http2/h2c: restore documentation of NewHandler unsafety\n\nAdd the warning about NewHandler reading an entire request into memory back\ninto the documentation. (Lost when replacing the prior docs with a terse\ndeprecation notice.)\n\nChange-Id: I13468b2c63a58599ced9f322a2feb36b6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/816540\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "c354d3f669cd33e14548d5359f52fbf842daed39",
      "tree": "2e92ba40f03491c5458836a074d77e557b3b169c",
      "parents": [
        "580cba3e41a458046860750d77727ed935b94a77"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Aug 12 09:49:48 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Aug 14 09:05:56 2026 -0700"
      },
      "message": "internal/httpcommon: remove Host header from server request\n\nThe http.Request documentation states:\n\n\t// For incoming requests, the Host header is promoted to the\n\t// Request.Host field and removed from the Header map.\n\nMake our behavior match the documentation.\nPreviously, we would include a Host header in the Header map when\nthe sender sends no :authority pseudo-header, but does send a host header.\n\nFor golang/go#80066\n\nChange-Id: I92ad651321a4a87a74a8449a02d02a776a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/814080\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "580cba3e41a458046860750d77727ed935b94a77",
      "tree": "a9199483183162171ff6dcabcb934b379b68d784",
      "parents": [
        "21c1020e630b338daf30f7d909311a299699d522"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Aug 11 14:18:46 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 12 11:57:36 2026 -0700"
      },
      "message": "http3, internal/httpcommon: improve :authority/host header interactions\n\nImplement a variety of checks and behaviors involving the :authority\npseudo-header and the Host header.\n\nWhen both are present, both must match.\nThere may be no more than one Host header.\nWhen there is Host and no :authority, use Host as the authority.\nValidate the authority contents (same rules as used by HTTP/1 servers).\n\nFor golang/go#80065\n\nChange-Id: I01bfd826f4139384bd7910fc59a4109b6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/813520\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "21c1020e630b338daf30f7d909311a299699d522",
      "tree": "a0f66bea2cf9718fa384456679d8c242bcd502de",
      "parents": [
        "acc78e0d2b2c855c0c4fbdcfe5f42a9e3d0f9778"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Aug 11 15:43:36 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 12 11:09:59 2026 -0700"
      },
      "message": "internal/httpcommon: drop net/http dependency in tests\n\nPermits us to copy the tests into std as well.\n\nChange-Id: Iee5672b00a39e4d785f0f11a148cf9396a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/813580\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "acc78e0d2b2c855c0c4fbdcfe5f42a9e3d0f9778",
      "tree": "85f3687cfc2b986b2b0d85f6aa22de7264539abf",
      "parents": [
        "90d10f01d98d92403c7b2823ab62a977cd01c7c6"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 11 11:17:28 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 12 10:41:32 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I79a762b016aa660c10f8c05557a79b05e98f695b\nReviewed-on: https://go-review.googlesource.com/c/net/+/813281\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "90d10f01d98d92403c7b2823ab62a977cd01c7c6",
      "tree": "38f7e621537609b0dbd2e3f033b08c15eb6807b1",
      "parents": [
        "08abf4d948c22eae54ea207977c8ee700412a442"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Aug 11 17:53:55 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 12 10:12:10 2026 -0700"
      },
      "message": "internal/http3: delete invalid Content-Length if declared in server handler\n\nFollowing our HTTP/1 and HTTP/2 server implementations, when a\nContent-Length header is set to an invalid value in a server handler, it\nshould be stripped.\n\nAlso change responseWriter.bodyLenLeft to be int64, to avoid possible\noverflow shenanigan on 32-bit systems.\n\nFor golang/go#70914\n\nChange-Id: I76174d81e7b5993b62a32235ba5008f76a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/813560\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "08abf4d948c22eae54ea207977c8ee700412a442",
      "tree": "c18d3d9e34a63202e1c0da5bf85d735b2adad31c",
      "parents": [
        "8d10596d262406469433c798878f7a33b1a8d6c4"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 10 12:32:42 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 10 15:41:33 2026 -0700"
      },
      "message": "internal/http3: infer headers when Content-Encoding is set but is empty\n\nTestContentEncodingNoSniffing in std verifies that when a\nContent-Encoding header is set to an empty value, it is considered as if\nthe header is not set at all, and that Content-Type header should be\ninferred.\n\nMake HTTP/3 behave similarly to HTTP/1 and HTTP/2 implementations in\nthis regard.\n\nFor golang/go#70914\n\nChange-Id: Icbb60fd00f182c1ddc4e2372e4d2e4686a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/812760\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "8d10596d262406469433c798878f7a33b1a8d6c4",
      "tree": "7e74a3aae5c2582c64dc7a52e61f9d5173cb6612",
      "parents": [
        "99c3b0a8f463fdf9bfde3b2cb50599ee53891eb0"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Sat Aug 01 09:12:13 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 04 12:21:08 2026 -0700"
      },
      "message": "http2: avoid deadlocks in wrapped ClientConn state callback\n\nAn http2.ClientConn wraps an http.ClientConn.\nThe http.ClientConn calls back to the http2.ClientConn\u0027s\nstate hook on certain state changes.\n\nSince the state hook acquires the http2.ClientConn\u0027s mutex,\nholding the mutex while calling an http.ClientConn method\nwhich can trigger a state hook call can cause a deadlock.\n\nAvoid deadlocks in two places where the http2.ClientConn\nheld its mutex while calling http.ClientConn.Reserve.\n\nFixes golang/go#80680\n\nChange-Id: I9b4107e1461d451cdb2eae7b102bd9ba6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/808900\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Brad Fitzpatrick \u003cbradfitz@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "99c3b0a8f463fdf9bfde3b2cb50599ee53891eb0",
      "tree": "69d968d3628784fbab06fd128f2945324b974274",
      "parents": [
        "5a920b1a80900b1da0d73d18b73c193f7b52b901"
      ],
      "author": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Wed Jul 29 02:11:09 2026 +0000"
      },
      "committer": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Wed Jul 29 16:30:39 2026 -0700"
      },
      "message": "http2/hpack: build the table lookup maps lazily, only for encoders\n\nThe headerFieldTable byName and byNameValue maps exist to serve\nsearch, which is only reachable from the Encoder. Decoder dynamic\ntables allocated and maintained them anyway, for every entry ever\nadded or evicted, even though nothing ever read from them.\n\nFor servers with many mostly-idle HTTP/2 connections, each pinning a\ndecoder dynamic table for the connection\u0027s lifetime, those maps are a\nmeaningful fraction of per-connection memory: on one proxy instance\nwith ~124k long-poll connections, hpack table maps accounted for\n~230MB of live heap.\n\nBuild the maps lazily on the first search call instead, so decoders\nnever allocate them. Encoder behavior is unchanged: its first\nWriteField builds the maps from the (usually empty) table and\nmaintains them incrementally from then on, as before.\n\nChange-Id: I1db5d23c3ea8202497a559f70cdcd597f14fefa1\nReviewed-on: https://go-review.googlesource.com/c/net/+/807260\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "5a920b1a80900b1da0d73d18b73c193f7b52b901",
      "tree": "c7756bb4f0d828e2fa8c04a88361eafa8b35b7d8",
      "parents": [
        "7fd284277aab94a6bd16c6a50b7604958f7a18a1"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 15 14:02:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Jul 23 13:43:03 2026 -0700"
      },
      "message": "http3: rework registration to allow using a fake network\n\nThis is the x/net half of a paired set of changes which modify\nthe mechanism by which x/net/http3 integrates with net/http.\nThe other half of the change is CL 803380.\n\nx/net/http3 exports two functions via linkname for use by\nnet/http\u0027s tests. These are now:\n\n\tregisterServer(*http.Server, opts any) error\n\tregisterTransport(*http.Transport, opts any) error\n\nThese are now thin wrappers around the interal/http3 registration\nfunctions, with a bit of reflection-based struct copying to permit\npassing in options without exporting the options types.\n\n(The end state is for these functions to be exported and take\nexported options types.)\n\nServer registration no longer uses TLSNextProto.\nInstead, the HTTP/3 server registers itself via net/http.Server.Serve,\nwhich is the same approach used by x/net/http2.\nThis gives us a simpler link between the two packages.\nFor example, net/http can just call a Shutdown method on the HTTP/3 server\nand pass it a Context, rather than the prior complex dance.\n\nThe HTTP/3 server no longer calls net.Listen.\nIt always accepts a net.PacketConn from net/http.\n\nTransportOpts now has a ListenPacket field, in addition to ListenQUIC.\n\nServer and Transport now both accept their *tls.Configs from net/http.\nnet/http is responsible for correctly configuring NextProtos.\nThis makes TLS config construction more consistent overall,\nsince net/http already sets up the HTTP/1 and HTTP/2 configs.\n\nThese changes simplify the registration machinery in some places,\nbut mainly permit us to now pass a fake net.PacketConn from\nnet/http\u0027s tests into the http package.\n\nAs part of this change, the HTTP/3 server\u0027s handler and base context\nare now per-endpoint rather than per-server.\n\nnet/http Servers permit setting a per-net.Listener base context\nfor request handlers. Treating the HTTP/3 base context as per-endpoint\nmaintains the equivalent ability. Making the handler per-endpoint\nisn\u0027t strictly necessary, but is consistent with the context and\nsimplifies the connection between net/http and x/net/http3.\n\nFor golang/go#80480\n\nChange-Id: I10d6e998c11cade33e517d1d2f03a2d86a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801940\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "7fd284277aab94a6bd16c6a50b7604958f7a18a1",
      "tree": "fdf7b0649d5ed8a45a5866f98f6c7fb88b3949f0",
      "parents": [
        "825111d7f2d2ccf50aa8eb63f62da04e2e3c5dc6"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Jul 17 12:07:49 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jul 21 14:46:59 2026 -0700"
      },
      "message": "quic: return an error from Accept after PacketConn reader exits\n\nIf we encounter an error reading from an endpoint\u0027s PacketConn,\nthe reader exits and the endpoint becomes unusable.\n\nReturn an error from Accept, rather than blocking forever.\n\nChange-Id: Ia3c306d37d93c857be05999b9c642f456a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/803300\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "825111d7f2d2ccf50aa8eb63f62da04e2e3c5dc6",
      "tree": "1dc8dacb01cf3c96f7f93d0c481af5e5a5a2105a",
      "parents": [
        "a02ddfa7eacb4cf63a5bea6b23761244a6df69f6"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Jul 16 09:29:10 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jul 21 14:46:56 2026 -0700"
      },
      "message": "quic: avoid busy-loop when keep-alive is blocked by congestion control\n\nWhen a connection\u0027s keep-alive timer expires, we send a PING frame.\nSending an ack-eliciting frame such as a PING clears the idle timer.\nHowever, if the frame could not be sent (due to being blocked by\ncongestion control, for example), the keep-alive timer was not cleared\nresulting in the connection event loop busy-waiting on the timer.\n\nNow, when the keep-alive timer expires we clear it immediately and\nset a flag indicating that we want to send a keep-alive.\n\nMinor related fix: Disable the keep-alive and idle timers when\nentering the closing/draining states. (We never set these timers\nwhen in these states, but we failed to clear them on entry.)\n\nChange-Id: I9f3f2327f2138273b7e10c4185cf9c176a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801882\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "a02ddfa7eacb4cf63a5bea6b23761244a6df69f6",
      "tree": "b5536a80e2da617cfde016fee58bba49096da5c2",
      "parents": [
        "574e5eb9d32de67fb16096316d40bb9c412e4906"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Thu Jul 16 13:18:01 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jul 20 13:04:44 2026 -0700"
      },
      "message": "http/httpproxy: prioritize lowercase proxy environment variables\n\nFor HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables,\nprioritize the lowercase version if both the uppercase and lowercase\nversions are set. While there is not an official standard, prioritizing\nthe lowercase environment variables seem to be what most implementations\nhave converged on. Therefore, we might as well follow.\n\nThis change should be relatively safe. Users will only observe a\nbehavior difference should they be setting both an uppercase and\nlowercase proxy environment variables with different values.\n\nFor golang/go#79656\n\nChange-Id: Ife71d260bcc61c52617a05cf5c3d53fb6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801700\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "574e5eb9d32de67fb16096316d40bb9c412e4906",
      "tree": "c91f5b8dd8932b228910e6d613370a1b51f39fb9",
      "parents": [
        "0da447f3719ea55fe4804c143b468c1f3c2a195e"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 15 14:02:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jul 17 12:53:44 2026 -0700"
      },
      "message": "quic: halt conn goroutines on close when listener exits early\n\nEndpoint.Close could return with conn goroutines still running\nif the endpoint\u0027s PacketConn was closed prior to the last conn\nexiting. (Normally the last conn to exit closes the PacketConn.)\nClean up any stray conns before returning.\n\nChange-Id: I444f7dbb1e7b194c74a1ff8025abb4346a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801881\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "0da447f3719ea55fe4804c143b468c1f3c2a195e",
      "tree": "0e384c88eb1f3d8ef4ac2417bc0788fe4b955d3c",
      "parents": [
        "e7e2eb826435a8a87bdce4722d252732fb5ad42e"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 15 14:02:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jul 17 12:53:40 2026 -0700"
      },
      "message": "quic: permit Config.Clone on a nil Config\n\nThe documentation says this is okay,\nbut the implementation disagreed.\n\nChange-Id: I1f88aa2b9e4f1c05ccad3aac3622586f6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801880\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "e7e2eb826435a8a87bdce4722d252732fb5ad42e",
      "tree": "59c4a0fa7fd61579669d75057a85b154102dabd5",
      "parents": [
        "6ae817d64941bbcea5838701b6dad7af41047e66"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jul 13 12:19:52 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jul 13 17:11:23 2026 -0700"
      },
      "message": "internal/http3: prevent request body read when 100 status was not sent\n\nMake HTTP/3 pass TestServerExpect100ContinueUnreadBody that was added in\nCL 793160.\n\nAlso add serverRequestReader so the server will always deal with the\nsame req.Body. This makes the code simpler and gets rid of the scattered\nlogic used to coordinate bodyReader and responseWriter.\n\nFor golang/go#70914\n\nChange-Id: Ic94c222f39e83e121012ddcd2579a2b66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/798321\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "6ae817d64941bbcea5838701b6dad7af41047e66",
      "tree": "7db0055707b17bc8de73cee2e56c6cf035729b90",
      "parents": [
        "a3c1227e666da136a7d1dbc685c4842492d34c36"
      ],
      "author": {
        "name": "ismailshadow",
        "email": "ismailismailgamal52@gmail.com",
        "time": "Mon May 25 16:02:58 2026 +0000"
      },
      "committer": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Fri Jul 10 10:39:57 2026 -0700"
      },
      "message": "dns/dnsmessage: add boundary check in unpackSVCBResource\n\nCurrently, bodyEnd is calculated using the length parameter from the\nresource header without verifying if it exceeds the physical capacity\nof the msg buffer.\n\nIf a malformed record provides a length that\nexceeds the buffer, it bypasses the first-pass parameter validation\nand causes an out-of-bounds slice during the second-pass copy.\n\nAdding a check against len(msg) aligns this function with the boundary\nenforcement used throughout the rest of the package.\n\nChange-Id: I13f6ca83d1c30eac02286a49c12f8ec543d33e41\nGitHub-Last-Rev: 78c35a160c45f09f2db04d9ec076dfb091a15595\nGitHub-Pull-Request: golang/net#249\nReviewed-on: https://go-review.googlesource.com/c/net/+/781880\nReviewed-by: Sean Liao \u003csean@liao.dev\u003e\nReviewed-by: ISMAIL GAMAL \u003cismailismailgamal52@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "a3c1227e666da136a7d1dbc685c4842492d34c36",
      "tree": "0441615c9d9118fd8102ec5799f1ab4b3654aa9e",
      "parents": [
        "b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jul 07 10:59:12 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 17:33:50 2026 -0700"
      },
      "message": "internal/http3: implement server read and write deadlines\n\nThe HTTP/3 server now enforces the net/http server\u0027s ReadHeaderTimeout,\nReadTimeout, and WriteTimeout that is registered via RegisterServer.\n\nAlso clean up logic related to stream closure and reset in the server\nimplementation. Instead, just return the appropriate error and let\ngenericConn.handleStreamError deal with the stream closure and reset.\n\nIdleTimeout is not yet implemented and will be added separately.\n\nFor golang/go#70914\n\nChange-Id: Ie7aaebb673ad6a6386c6cbce273446466a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/798060\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nAuto-Submit: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5",
      "tree": "c73b305ee8763f750716c88c122ac5859481df27",
      "parents": [
        "f05f21be5927155a88b371674c298ada54b71cf5"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 11:49:09 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 14:02:14 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I7f67042b70ae290dc0ca73793ad35882e395e629\nReviewed-on: https://go-review.googlesource.com/c/net/+/798460\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "f05f21be5927155a88b371674c298ada54b71cf5",
      "tree": "49059e8d40bec08315c0200da01ea46c48da15c8",
      "parents": [
        "0f748cfbba95084c87723e3b7eb7dad9241fc2dd"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 01 16:00:33 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jul 07 15:13:12 2026 -0700"
      },
      "message": "idna: reject all-ASCII xn-- labels on all Go versions\n\nChange generated from x/text with CL 796420 applied.\n\nFor golang/go#78760\n\nChange-Id: Ie6233f98492821f3e42b726488d9a9856a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/796421\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "0f748cfbba95084c87723e3b7eb7dad9241fc2dd",
      "tree": "614d6f25632cc89833af9f10222a5676408ea06f",
      "parents": [
        "0bb961e45132c680e2a0117e1df951538a19da61"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 22 23:02:03 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jul 07 09:41:15 2026 -0700"
      },
      "message": "internal/http3: clean up stream I/O methods usages in tests\n\nIn CL 796400, I/O methods were added to the internal/http3.stream. As a\nfollow-up to that CL, modify our tests to stop calling I/O methods from\ninternal/quic.stream.\n\nAlso add internal/http.stream.WriteByte method for symmetry.\n\nFor golang/go#70914\n\nChange-Id: I2036589d89ceac97f80e3f34a29cea786a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/797280\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "0bb961e45132c680e2a0117e1df951538a19da61",
      "tree": "969605e15003715411ada1851f5a4f0e761b16d0",
      "parents": [
        "0ca694d2a5adcce7f36d4d65e5f8d72390d94051"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 16 15:06:43 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jul 06 12:36:43 2026 -0700"
      },
      "message": "internal/http3: add net/http.ResponseController support\n\nServer now implements SetReadDeadline, SetWriteDeadline,\nEnableFullDuplex, and FlushError (with Hijack being left unsupported\nintentionally as HTTP/3 does not support hijacking).\n\nFor golang/go#70914\n\nChange-Id: I0821d6eec4e534e01a33f1ea923ae59d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/792000\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "0ca694d2a5adcce7f36d4d65e5f8d72390d94051",
      "tree": "e1555c6891ddf320299ae9f0dbc163b3fb3e860a",
      "parents": [
        "bd5f1dcf71cf0d6d2424021d0a04f191396a46a7"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 30 14:53:11 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 01 09:03:05 2026 -0700"
      },
      "message": "webdav: document Dir\u0027s lack of defense against filesystem modification\n\nChange-Id: Id2d5f4053497445e006ca30229a1925e6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/795860\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "bd5f1dcf71cf0d6d2424021d0a04f191396a46a7",
      "tree": "af7cd40063344ad7daa8c44250a16b5eb451dfe2",
      "parents": [
        "488ff63197ffddbcef2d01107f8a89906a4f28d1"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Jun 29 21:35:12 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 30 13:52:41 2026 -0700"
      },
      "message": "http2: initialize Transport on NewClientConn\n\nAdd a missing init call in the NewClientConn path.\n\nMissing init calls are hard to write a test for, since the\nTransport test infrastructure causes the Transport to be\ninitialized before the test begins. So instead, make it harder\nto forget the call: init now returns the net/http *Transport,\nso code which uses it needs to call init to get it.\n\nFixes golang/go#80198\n\nChange-Id: Ib6465b863bb0be3cd3d02d9c1bb349526a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/795600\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "488ff63197ffddbcef2d01107f8a89906a4f28d1",
      "tree": "d4e29ca7eec0428d58b5f916f667ef30665c4178",
      "parents": [
        "93d1f25be95961edfdf488b9398e53fb9f05f193"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 30 11:28:31 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 30 13:52:17 2026 -0700"
      },
      "message": "bpf: add security considerations to package docs\n\nChange-Id: I9d9bd9b66f6b5290ecd356fcefb1659d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/795780\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "93d1f25be95961edfdf488b9398e53fb9f05f193",
      "tree": "40f49fcdd7ce9d2f70d538a892a7f965715506b1",
      "parents": [
        "5a3baee349e65853c34b4377bebe7676a64dbc87"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 23 16:30:13 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jun 24 07:54:26 2026 -0700"
      },
      "message": "xsrftoken: avoid token collisions\n\nAdjust token sanitization to avoid collisions.\nFor example, previously (\"u:\", \"a\") and (\"u\", \":a\")\nboth produced the (pre-hashing) token \"u:::a:\u003ctimestamp\u003e\".\n\nFixes golang/go#80125\n\nChange-Id: Ia932b762096abaa32bb790999c8e21e56a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/793540\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "5a3baee349e65853c34b4377bebe7676a64dbc87",
      "tree": "ffc164e3d443965def31ad0c325c70b6bdf75c6f",
      "parents": [
        "9e7fdbfadb32b0cc7524100014c5cf9b6adc7729"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 23 12:56:25 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 23 13:10:39 2026 -0700"
      },
      "message": "internal/http3: prevent panic in QPACK decoder due to overflow\n\nChange-Id: I4b887a2b888aac80203badbc4d0dc1356a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/793363\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "9e7fdbfadb32b0cc7524100014c5cf9b6adc7729",
      "tree": "2eea34906f7b8d8d422566c0de2cc34f5ca7f5ad",
      "parents": [
        "b686e5f3573e5f55120d664fc283ed7e80c1af3c"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 09 12:47:33 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 09 09:58:42 2026 -0700"
      },
      "message": "internal/http3: fix wrong argument being given when validating header value\n\nChange-Id: I04eb0db74bfe677829d06623ec3ab77d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/788880\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nAuto-Submit: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b686e5f3573e5f55120d664fc283ed7e80c1af3c",
      "tree": "ca3d63f99223608fb40588825f0f80adff64fa61",
      "parents": [
        "8a348850ed6818306667722af2b42a6fc63473e0"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 29 14:50:25 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 08 14:06:00 2026 -0700"
      },
      "message": "internal/http3: add gzip support to transport\n\nHTTP/3 now behaves similarly to HTTP/1 and HTTP/2 in terms of gzip\nsupport. Implementation of gzip reader and its pool are taken from\nnet/http.\n\nFor golang/go#70914\n\nChange-Id: I829c0b9472e4c698b0f1a4012d8659b46a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/785120\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "8a348850ed6818306667722af2b42a6fc63473e0",
      "tree": "7b7d7c93354ed029c1726b30c5949dd5fcd4dba7",
      "parents": [
        "72eaf98743302f6e0ad10883163dfc46dc8e8183"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 08 09:05:07 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 08 10:06:21 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I6d18e0698f4d3c81f5fd3d5ab8a9200b23602199\nReviewed-on: https://go-review.googlesource.com/c/net/+/788223\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "72eaf98743302f6e0ad10883163dfc46dc8e8183",
      "tree": "5e7304920c91d2af82c97df51e50c50c2e70d28b",
      "parents": [
        "82e7868a02167540748b74780b0bf825985256f7"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 02 15:06:17 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Jun 08 09:07:53 2026 -0700"
      },
      "message": "dns/dnsmessage: correctly validate SVCB record parameter order\n\nFix a bug which caused us to not properly validate the order\nof parameters in SVCB/HTTPS records.\n\nFixes golang/go#79796\n\nChange-Id: I9d3c43bde06f3d25786a5b89e45613e76a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/786346\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "82e7868a02167540748b74780b0bf825985256f7",
      "tree": "4f29cd03570d2cbb4f6f34ab3d36c503118268d2",
      "parents": [
        "b64f1fa4c615965246e5b9e5c9d614916fa8967d"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 02 14:48:48 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jun 05 11:05:24 2026 -0700"
      },
      "message": "dns/dnsmessage: avoid panic when parsing SVCB record with truncated data\n\nThanks to Mundur (https://github.com/M0nd0R) for reporting this issue.\n\nFixes golang/go#79795\nFixes CVE-2026-46600\n\nChange-Id: Ie32a9dae6789eb98c816bc7508feba686a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/786345\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "b64f1fa4c615965246e5b9e5c9d614916fa8967d",
      "tree": "ccf6064868537a2a947d523e3c5625d9397a77d6",
      "parents": [
        "2707ee21efea70599446dd35979b1d1aedf44ada"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 01 17:12:20 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu Jun 04 11:26:45 2026 -0700"
      },
      "message": "internal/http3: add server support for \"Trailer:\" magic prefix\n\nSimilar to our HTTP/1 and HTTP/2 implementations, allow HTTP/3 server\nhandler to send trailer headers that have not been declared prior to\nwriting response body by using the \"Trailer:\" magic prefix.\n\nTo support this, also modify transport to accept all trailers, even\nthose that have not been declared. This is consistent with the behavior\nof our HTTP/1 and HTTP/2 implementations. Note the following,\nunfortunately somewhat convoluted, behavior:\n\n1. Transport will never send undeclared trailers.\n2. Transport will accept undeclared trailers.\n3. Server will never accept undeclared trailers.\n4. Server will never send undeclared trailers, unless they use the\n   \"Trailer:\" magic prefix.\n\nFor golang/go#70914\n\nChange-Id: Ifa5e026eb6ce68af9a8364845e4f2def6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/785860\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Viacheslav Danilin \u003cviacheslavdanilin@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "2707ee21efea70599446dd35979b1d1aedf44ada",
      "tree": "5ab1a92771765ec09baa2a57b74d0e360ddc5d52",
      "parents": [
        "31358cc259a764905194e3d6c597375b0ff366c1"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue May 26 15:31:29 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu Jun 04 09:49:23 2026 -0700"
      },
      "message": "internal/http3: implement HTTP/3 clientConn methods\n\nImplement Err, Reserve, Release, Available, and InFlight methods in our\nHTTP/3 implementation. This allows clientConn to implement the\ngenericClientConn interface in net/http.\n\nGiven that we have no good understanding yet of when one might want to\ncreate multiple HTTP/3 connections to the same server, Available will\nalways return MaxInt.\n\nFor golang/go#70914\n\nChange-Id: Ib1316b33195b6f5d584c5a371d60cddf6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/784500\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "31358cc259a764905194e3d6c597375b0ff366c1",
      "tree": "775c8ae1b26943970b073ecccb48c0bd96929304",
      "parents": [
        "8ecbaa95fea823c19fa74c5c3b53e0bccd473828"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 29 13:43:51 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Jun 03 15:04:37 2026 -0700"
      },
      "message": "internal/http3: snapshot response headers at WriteHeader time\n\nHTTP/3 currently buffers small body writes. As a result, if a server\nhandler modifies its headers after WriteHeader has been called, the\nmodified headers will be sent by the server as part of its response.\nThis behavior is generally unexpected and inconsistent with our HTTP/2\nimplementation.\n\nTherefore, change HTTP/3 server to snapshot the headers at WriteHeader\ntime, to ensure that buffering responses will not result in different\nheaders being sent.\n\nFor golang/go#70914\n\nChange-Id: Ie1ed44f2cfc3d60ac28d8bb64118bd846a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/784960\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "8ecbaa95fea823c19fa74c5c3b53e0bccd473828",
      "tree": "1db32a7a2992048e7bb2a627f54cb09a8bc11822",
      "parents": [
        "8ae811abe5c2daa55c68d51a101af1c5751a4d55"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 05 13:50:37 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:06:09 2026 -0700"
      },
      "message": "html: don\u0027t adjust xml:base\n\nChange-Id: Ifac8571bedbb153b7e97ce2d2af47b5bc05b381c\nReviewed-on: https://go-review.googlesource.com/c/net/+/781893\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "8ae811abe5c2daa55c68d51a101af1c5751a4d55",
      "tree": "69cad35a6cd11e02501e4767342a3cebd4442e79",
      "parents": [
        "3e9891da1ce72c7c271efec3cf516b42377a37b8"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 05 13:33:58 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:06:05 2026 -0700"
      },
      "message": "html: properly handle end script tag in fragment mode\n\nChange-Id: I10af60ce9aa6ffc2f2bc330026f9e4bc5cb30bb7\nReviewed-on: https://go-review.googlesource.com/c/net/+/781892\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "3e9891da1ce72c7c271efec3cf516b42377a37b8",
      "tree": "6482ce1582f2b521c88e0a235066ec14efcc3d08",
      "parents": [
        "5a0480ccee4f718e5963b6721d27a5f1c14326dc"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 05 12:58:24 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:14 2026 -0700"
      },
      "message": "html: add selectedcontent tests to skip list\n\nChange-Id: I052e06968da12795accaec7e8bb99f1ec2013ff5\nReviewed-on: https://go-review.googlesource.com/c/net/+/781891\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "5a0480ccee4f718e5963b6721d27a5f1c14326dc",
      "tree": "2936924cec8d947f624e949f31a67e6aff9367cf",
      "parents": [
        "86561db28616030146d65e44420acd03613a7fa2"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 21:01:29 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:11 2026 -0700"
      },
      "message": "html: update parser to match spec select behavior\n\nChange-Id: Idfbe3805907b6274cae07ec70f10108ab07696cd\nReviewed-on: https://go-review.googlesource.com/c/net/+/781890\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\n"
    },
    {
      "commit": "86561db28616030146d65e44420acd03613a7fa2",
      "tree": "4d38860a88ee957af0e0b1bc22d4a56d869b36f5",
      "parents": [
        "93a0bd91d9850a867c717fa435370044cbf97c5a"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 17:20:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:08 2026 -0700"
      },
      "message": "html: properly handle fragment foreign content breakout\n\nChange-Id: I8a97547c58fc74cb3c551a4a63f300a7254108f7\nReviewed-on: https://go-review.googlesource.com/c/net/+/781889\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "93a0bd91d9850a867c717fa435370044cbf97c5a",
      "tree": "523ceab6a24aa931633a882a4fad32ebafe8e078",
      "parents": [
        "42abb857022cb79baacfa240bcf48588aa80bbee"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 17:20:29 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:05 2026 -0700"
      },
      "message": "html: switch from the webkit tests to html5lib-tests\n\nChange-Id: I40b16419113892de7be38903a0dbfab68ba8f68b\nReviewed-on: https://go-review.googlesource.com/c/net/+/781888\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "42abb857022cb79baacfa240bcf48588aa80bbee",
      "tree": "a2387d142ec4055cdd7dab6ad31488fb29fca649",
      "parents": [
        "9d1bca88f13459b48f25f8c3226621c55fcd56f7"
      ],
      "author": {
        "name": "Davanum Srinivas",
        "email": "davanum@gmail.com",
        "time": "Mon Jun 01 20:44:10 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 08:30:38 2026 -0700"
      },
      "message": "http2: enable HTTP/2 in wrap configureTransport\n\nThe go1.27 wrap implementation of ConfigureTransport is a no-op, and\nConfigureTransports only registers the protocol with net/http; neither\nenables HTTP/2 on the transport or initializes TLSClientConfig. The\npre-wrapping transport.go did both.\n\nAs a result, callers that enable HTTP/2 on a transport with a custom\nTLSClientConfig or dialer (where net/http does not enable HTTP/2\nautomatically) send requests over HTTP/1 to an HTTP/2 server. Without\n\"h2\" in NextProtos this is a silent downgrade to HTTP/1.1; with it, the\nconnection negotiates h2 at the TLS layer but is read by the HTTP/1\ntransport, failing with \"net/http: HTTP/1.x transport connection broken:\nmalformed HTTP response\".\n\nThis is the client-side counterpart of the server-side fix in CL 782940.\nconfigureTransport now delegates to configureTransports, which ensures a\nnon-nil TLSClientConfig and enables net/http\u0027s native HTTP/2 via\nTransport.Protocols.\n\nTestConfigureTransport is gated to the legacy build\n(!(go1.27 \u0026\u0026 !http2legacy)) and does not compile into the wrapper build,\nwhich is why this regressed silently. The new transport_configure_test.go\nis untagged and exercises both ConfigureTransport and ConfigureTransports\nunder the legacy and wrap builds.\n\nFixes golang/go#79778\n\nChange-Id: Ibc27bced8679fcb3baa7953bad12315da07535fb\nReviewed-on: https://go-review.googlesource.com/c/net/+/785900\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "9d1bca88f13459b48f25f8c3226621c55fcd56f7",
      "tree": "72abc5834a34e1e6b21f7a80db7d0f1a0f2ad841",
      "parents": [
        "ed393feb7de2574616a34134c213042fa6be899f"
      ],
      "author": {
        "name": "cuishuang",
        "email": "imcusg@gmail.com",
        "time": "Sat May 30 23:52:06 2026 +0800"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:36 2026 -0700"
      },
      "message": "all: fix some comments to improve readability\n\nChange-Id: I8aa8f216b60abbf3f36ad4112310a2ea221f9d91\nReviewed-on: https://go-review.googlesource.com/c/net/+/785340\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "ed393feb7de2574616a34134c213042fa6be899f",
      "tree": "0de9db9a9aa6c988bb6f9b0f86a55ef1ea1c94e6",
      "parents": [
        "d4238335f2996a6f6d74e63e3083b29043f8703b"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 23 13:16:16 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:33 2026 -0700"
      },
      "message": "html: properly emit comment token when eof in markup declaration open state\n\nIn particular, if we hit a EOF while looking for the \"DOCTYPE\" or\n\"[CDATA[\", properly emit a comment token with the fragment, rather than\nemitting an empty comment token.\n\nChange-Id: I749a88b5a894f8c8c38d9ebc6bb78fc7f7626a71\nReviewed-on: https://go-review.googlesource.com/c/net/+/782300\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "d4238335f2996a6f6d74e63e3083b29043f8703b",
      "tree": "052b00038ab21c4684a74ce819300cbd1310b2be",
      "parents": [
        "7c3abf5d0c5aadd4cb49beb18d4f8965e33fec1d"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Fri May 22 13:30:43 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:30 2026 -0700"
      },
      "message": "html: properly handle unicode attribute dup detection\n\nWhen checking if an attribute is a duplicate, only lowercase ASCII\ncharacters, ignoring unicode.\n\nChange-Id: I62646c41fc47c674dec274737fa1198c8b63816d\nReviewed-on: https://go-review.googlesource.com/c/net/+/782260\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "7c3abf5d0c5aadd4cb49beb18d4f8965e33fec1d",
      "tree": "a78171401be0ae815ef5e47837b95e6bcfc8780e",
      "parents": [
        "2d3cf22512d4f0200c7c3696ab75fdf410c929a0"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 14:30:08 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:26 2026 -0700"
      },
      "message": "html: support named entities shorter than their encoding\n\nChange-Id: Ica0522cd4213cf38023c10695e314f929c021f48\nReviewed-on: https://go-review.googlesource.com/c/net/+/781886\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n"
    },
    {
      "commit": "2d3cf22512d4f0200c7c3696ab75fdf410c929a0",
      "tree": "fbc137641443be2380eda75fcbc7a1c7f218c808",
      "parents": [
        "3f77b0808bcbbe3f091c9684dd63df86a1088d20"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 13:31:37 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:22 2026 -0700"
      },
      "message": "html: properly parse zero numeric entity\n\nChange-Id: Icb5db53ce9dc28d367f6652e91ab4966a7b38ac3\nReviewed-on: https://go-review.googlesource.com/c/net/+/781885\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "3f77b0808bcbbe3f091c9684dd63df86a1088d20",
      "tree": "51e6143279dabac98a7cf92db0a9203938d99b18",
      "parents": [
        "1e933f51e39b3fea170c6defa9f3c12011c1473e"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 13:28:05 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:19 2026 -0700"
      },
      "message": "html: avoid overflow when decoding numeric entities\n\nChange-Id: I18a7817a16ecb45c343565e94141e94bd50242d6\nReviewed-on: https://go-review.googlesource.com/c/net/+/781884\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "1e933f51e39b3fea170c6defa9f3c12011c1473e",
      "tree": "fc95924a6a9dcf617abb4e4ef29be7fd045b9e3c",
      "parents": [
        "088b2ce7682db4b4a9f6e0b1b2513f25256cbcb3"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 12:24:22 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:16 2026 -0700"
      },
      "message": "html: replace nul bytes in tag names and attributes\n\nChange-Id: I34063225c9179844b1220e798e18ce6a20b097e0\nReviewed-on: https://go-review.googlesource.com/c/net/+/781883\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "088b2ce7682db4b4a9f6e0b1b2513f25256cbcb3",
      "tree": "58acfe912b74a6fa7e64b36223e606b7c9a2a6e8",
      "parents": [
        "65e84c3ad8f4f4a13be20b3a030c7c278960fe04"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 11:59:09 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:12 2026 -0700"
      },
      "message": "html: properly handle bogus comment \u003c!\u003e\n\nChange-Id: I9358382378cbbcfbd055d7fa2341280ff991b74c\nReviewed-on: https://go-review.googlesource.com/c/net/+/781882\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "65e84c3ad8f4f4a13be20b3a030c7c278960fe04",
      "tree": "bfc0dc36902f40c74a07c15bc361c835135a5a1d",
      "parents": [
        "008e5e7789e6ebd2d598cf87289d0cf6fea55ddc"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 11:25:51 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:09 2026 -0700"
      },
      "message": "html: add html5lib-tests tokenizer test suite\n\nDisable a bunch of failing tests for now so we can fix them in follow\nups.\n\nChange-Id: I8bbce9d8f138382a7dc0eb22dfed61d6ae08a79c\nReviewed-on: https://go-review.googlesource.com/c/net/+/781881\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "008e5e7789e6ebd2d598cf87289d0cf6fea55ddc",
      "tree": "c7871bb1146ad937804469645d94b45c2134a05f",
      "parents": [
        "db078759488c2fa21999184c21a2abdb1ab6b423"
      ],
      "author": {
        "name": "Davanum Srinivas",
        "email": "davanum@gmail.com",
        "time": "Mon May 25 18:26:00 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 01 11:48:02 2026 -0700"
      },
      "message": "http2: register h2 ALPN on s.TLSConfig in wrap configureServer\n\nThe go1.27 wrap implementation of configureServer did not initialize\ns.TLSConfig or append the h2 and http/1.1 ALPN protocols to its\nNextProtos, so callers that combine http2.ConfigureServer with their\nown TLS listener (e.g. tls.Listen or httptest.Server.StartTLS) ended\nup negotiating http/1.1 only, and HTTP/2 clients failed the TLS\nhandshake with \"tls: no application protocol\".\n\nMirror the corresponding block from the pre-wrapping server.go, using\nslices.Contains since strSliceContains lives in transport.go which is\ngated to the legacy build tag.\n\nFixes golang/go#79642\n\nChange-Id: Ib172422b88950d7c692bade24e40f75c4f143cd2\nReviewed-on: https://go-review.googlesource.com/c/net/+/782940\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "db078759488c2fa21999184c21a2abdb1ab6b423",
      "tree": "87e47a67664714a7d0013f5d2417a08d188320c3",
      "parents": [
        "657eb1317b5dd33038d683297c6be9cae05fa97d"
      ],
      "author": {
        "name": "Neal Patel",
        "email": "neal@golang.org",
        "time": "Fri May 29 11:33:56 2026 -0400"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "neal@golang.org",
        "time": "Fri May 29 09:46:14 2026 -0700"
      },
      "message": "all: bump x/crypto to 0.52.0\n\nFixes golang/go#79738\n\nChange-Id: I8a8381d8a2c1b81f66b46e0de5be86f5a11c2ecc\nReviewed-on: https://go-review.googlesource.com/c/net/+/784880\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "657eb1317b5dd33038d683297c6be9cae05fa97d",
      "tree": "43b136a996cba42fff92d2686dda9b9edada2ae8",
      "parents": [
        "7770ec48d03fec35e378665337b4faca93c38423"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 22 16:49:03 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue May 26 08:43:43 2026 -0700"
      },
      "message": "internal/http3: document possible issue in Darwin when using dual-stack binding\n\nFor golang/go#78737\n\nChange-Id: I1112c6ec5fcfe22513b6d80c792806056a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/782080\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "7770ec48d03fec35e378665337b4faca93c38423",
      "tree": "04db8f41cb27ab54739ee6cba10bfe7bc5fee105",
      "parents": [
        "4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:13:58 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:45:50 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I1905a384363c0893821050162b74ba3c6faed7ba\nReviewed-on: https://go-review.googlesource.com/c/net/+/781740\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nTryBot-Bypass: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905",
      "tree": "a60cd8c5a0594a0f4acd0c185c7c8a66be6da015",
      "parents": [
        "08be507abce89191d78cd49da60f4501fc910472"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 11:47:15 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:12:51 2026 -0700"
      },
      "message": "html: escape greater-than symbol in doctype identifiers\n\nDuring parsing, we unescape character references. When rendering, we\nre-escape certain characters in certain scenarios in order to avoid\ntoken content causing unexpected parser behavior.\n\nWe appear to have not taken this into account when rendering DOCTYPE\ntokens, allowing \"\u003e\" in PUBLIC/SYSTEM identifier strings, which trigger\na abrupt-doctype-system-identifier parse error which immediately emits\nthe current DOCTYPE token and then continues parsing in the data state.\n\nThis may cause bypass in HTML santizers which use the html package for\nparsing.\n\nThanks to ensy for reporting this issue.\n\nFixes CVE-2026-25681\n\nChange-Id: I1d5be92129d17bfbf0917148db2672d57c224a18\nReviewed-on: https://go-review.googlesource.com/c/net/+/781703\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nTryBot-Bypass: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "08be507abce89191d78cd49da60f4501fc910472",
      "tree": "e8f042fe54cba17bd6ca10fe7d58a98d600b7ec7",
      "parents": [
        "a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 12 15:36:39 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:12:48 2026 -0700"
      },
      "message": "html: improve Noah\u0027s Ark clause performance\n\nInstead of iterating over each element in the stack, and checking each\nattribute against each other attribute in a ~cubic fashion, sort the\nattributes and just use slices.Equal.\n\nThanks to IPC Labs for reporting this issue.\n\nFixes CVE-2026-25680\n\nChange-Id: Iec3513ba0b5da4f28f1359d24846401b9ab76ee3\nReviewed-on: https://go-review.googlesource.com/c/net/+/781702\nTryBot-Bypass: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n"
    }
  ],
  "next": "a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd"
}