)]}'
{
  "commit": "bb41b3dbe630c21c78e3aeb0ebdd8d06a3a34fcf",
  "tree": "f885c12fa8a07774a64f125f51a7e0891fb6273d",
  "parents": [
    "e04e7219970912a40f80c4b13029416fdf960eeb"
  ],
  "author": {
    "name": "Nicola Murino",
    "email": "nicola.murino@gmail.com",
    "time": "Sun May 24 17:26:02 2026 +0200"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Tue Jun 02 00:23:03 2026 -0700"
  },
  "message": "ssh: improve DH GEX group selection using PreferredBits\n\nPreviously, the server selected the Diffie-Hellman group based solely on\nthe MaxBits value provided by the client. This resulted in suboptimal\nmodulus selection, often ignoring the client\u0027s PreferredBits or selecting\na larger-than-necessary group.\n\nThis change implements a \"best fit\" selection algorithm similar to\nOpenSSH\u0027s choose_dh logic. It attempts to find the smallest available\ngroup larger than or equal to the client\u0027s PreferredBits, falling back to\nthe largest available group within the accepted range if no group above\nthe preference is available.\n\nAdditionally, this commit caches the parsed Oakley groups using\nsync.OnceValue, avoiding repeated big.Int parsing on every handshake\nwhile keeping the cost out of package initialization.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Idfa81bbcf354a7fb7b541cb4bbeb6e4a0181398a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782424\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5f7fdd85142f7eb688bfaa1acecd90805871b127",
      "old_mode": 33188,
      "old_path": "ssh/kex.go",
      "new_id": "91b771c4aeb7dc63880079a3e9c0b682599f5297",
      "new_mode": 33188,
      "new_path": "ssh/kex.go"
    },
    {
      "type": "modify",
      "old_id": "cb7f66a5092f61ce4519a8d7587350525805df7c",
      "old_mode": 33188,
      "old_path": "ssh/kex_test.go",
      "new_id": "068afc7b088690790aa1512050fb20874e1848fb",
      "new_mode": 33188,
      "new_path": "ssh/kex_test.go"
    }
  ]
}