)]}'
{
  "commit": "ffd87b4878fa98ca2908ec534e1a410bf095a35e",
  "tree": "97509a55df9b0c0f560a0e818c1259463f258663",
  "parents": [
    "4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946"
  ],
  "author": {
    "name": "Nicola Murino",
    "email": "nicola.murino@gmail.com",
    "time": "Sun Jan 25 15:55:17 2026 +0100"
  },
  "committer": {
    "name": "Neal Patel",
    "email": "nealpatel@google.com",
    "time": "Thu May 21 17:03:09 2026 -0700"
  },
  "message": "ssh: fix panic when authority callbacks are nil\n\nPreviously, if CertChecker.IsHostAuthority or CertChecker.IsUserAuthority\nwere left unset, calling CheckHostKey or Authenticate would result in a\nnil pointer dereference panic.\n\nThis change adds checks to ensure these callbacks are defined before\ninvocation, returning an error instead of panicking.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport.\n\nFixes golang/go#79563\nFixes CVE-2026-39835\n\nChange-Id: I2bd9c8d76646232e49f6aedc7b5334f3825918be\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781660\nCommit-Queue: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "139fa31e1ba3d2a1d9d096042151e88917c2d7f6",
      "old_mode": 33188,
      "old_path": "ssh/certs.go",
      "new_id": "b0032340633387dba30ef690d8751164122d9d45",
      "new_mode": 33188,
      "new_path": "ssh/certs.go"
    }
  ]
}