)]}'
{
  "commit": "e7c36ccb477ccdb9f0f9b77025a9384de23dcc9c",
  "tree": "c58b8ac61368c4d0eb0e0cb6a903972a393b32e8",
  "parents": [
    "0fb843a472225645e917c84f1f9744757f0bab14"
  ],
  "author": {
    "name": "Neal Patel",
    "email": "neal@golang.org",
    "time": "Thu May 21 10:29:46 2026 -0400"
  },
  "committer": {
    "name": "Neal Patel",
    "email": "nealpatel@google.com",
    "time": "Thu May 21 10:55:07 2026 -0700"
  },
  "message": "ssh/agent: prevent panic on pathological ed25519 inputs\n\nparseEd25519Key and parseEd25519Cert cast wire bytes\nto ed25519.PrivateKey without checking length; a short\npayload panics at priv[32:] in Public().\n\nFixes CVE-2026-46598\nFixes golang/go#46598\n\nChange-Id: I127bc6a22adff1c4beb4d54533062bebc388de47\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781360\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2a7658cf75c36f4a66433cd56b987b1a0d494cdc",
      "old_mode": 33188,
      "old_path": "ssh/agent/server.go",
      "new_id": "248ab6a9f9c202ecaed1e084a64442762d99f87b",
      "new_mode": 33188,
      "new_path": "ssh/agent/server.go"
    },
    {
      "type": "modify",
      "old_id": "6309e2d9ab39f01095d686e4c140db0755a10048",
      "old_mode": 33188,
      "old_path": "ssh/agent/server_test.go",
      "new_id": "9e790eb4284de84ae2f5935a978c1c19374ee8bc",
      "new_mode": 33188,
      "new_path": "ssh/agent/server_test.go"
    }
  ]
}