)]}'
{
  "log": [
    {
      "commit": "30a33513ff6dc70af58e35680e54167d239ce419",
      "tree": "6cb2bc43600fdb97c565c8ab51c83d0814a7e46d",
      "parents": [
        "16804593e8b00c730415e838741a00ce8260c302"
      ],
      "author": {
        "name": "Ville Vesilehto",
        "email": "ville@vesilehto.fi",
        "time": "Sun Oct 11 20:55:16 2026 +0000"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Fri Oct 30 08:31:54 2026 -0700"
      },
      "message": "ssh: allocate name lists in one piece when unmarshaling\n\nparseNameList split a comma-separated name list with bytes.Split and\nthen converted each part to a string, allocating the [][]byte from\nSplit and a separate string for every name. A kexinit message has ten\nname lists. For example, the one sent by the OpenSSH 10.3 client holds\n68 names in 1594 bytes.\n\nInstead, convert the list to a string once and split that with\nstrings.Split. The client already does for the server-sig-algs\nextension, so a name list takes two allocations no matter how many\nnames it has.\n\nThe names are now substrings of the list they came from. findCommon\nreturned the agreed name from the client\u0027s list, which on a server is\nthe peer\u0027s, and the negotiated algorithms are kept for the lifetime of\nthe connection. They would have kept the peer\u0027s key exchange, host\nkey, cipher and compression lists alive. This is over 1 KB per\nconnection for an OpenSSH client. Return the name from a local list\ninstead, so that nothing from the peer\u0027s kexinit outlives the key\nexchange.\n\ngoos: darwin\ngoarch: arm64\npkg: golang.org/x/crypto/ssh\ncpu: Apple M1 Max\n                         │  base.txt   │               new.txt                │\n                         │   sec/op    │    sec/op     vs base                │\nUnmarshalKexInitMsg-10     3.809µ ± 2%   2.383µ ± 11%  -37.44% (p\u003d0.001 n\u003d20)\n\n                         │   base.txt   │                new.txt                 │\n                         │     B/op     │     B/op      vs base                  │\nUnmarshalKexInitMsg-10     5.188Ki ± 0%   2.789Ki ± 0%  -46.23% (p\u003d0.000 n\u003d20)\n\n                         │  base.txt  │              new.txt               │\n                         │ allocs/op  │ allocs/op   vs base                │\nUnmarshalKexInitMsg-10     126.00 ± 0%   30.00 ± 0%  -76.19% (p\u003d0.000 n\u003d20)\n\nThe other benchmarks in the package are unchanged.\n\nFixes golang/go#82099\n\nChange-Id: Id75e931af48632ffb2a107cbd8a6fd622c29f93e\nGitHub-Last-Rev: 271b8ad174aca8dc5b59ba3044d0cc882161d2fe\nGitHub-Pull-Request: golang/crypto#377\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/848045\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "16804593e8b00c730415e838741a00ce8260c302",
      "tree": "e04fc0129e13bf307c3c61e946c795cadd5b9d50",
      "parents": [
        "7993d226477ae8ec6649531122a774bbd75e70a2"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Oct 26 20:03:01 2026 +0100"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu Oct 29 09:11:32 2026 -0700"
      },
      "message": "ssh/test: fix TestClientAuthDisconnect with OpenSSH 10.6\n\nOpenSSH 10.6 no longer counts rejected public key queries against\nMaxAuthTries, so the server did not disconnect after the public key\nattempt. Try password first, since a failed password always counts.\n\nChange-Id: Iaed53f812aef9aa3af8f9b5ab83306e9cdb751e3\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/854325\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "7993d226477ae8ec6649531122a774bbd75e70a2",
      "tree": "2450f157a6910f6abfb26966b7cd2ff1b698d4ce",
      "parents": [
        "8483352eef5b9101eec373284fce4a6ef634ed25"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Oct 04 18:48:09 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu Oct 29 09:11:14 2026 -0700"
      },
      "message": "ssh: escape non-printable characters in BannerDisplayStderr\n\nBannerDisplayStderr writes the banner sent by the server to stderr\nas is, so a server can send terminal escape sequences before the\nuser authenticates.\n\nReplace non-printable characters and invalid UTF-8 sequences with\nU+FFFD, keeping newlines, carriage returns and tabs.\n\nFixes golang/go#80302\n\nChange-Id: I51c6da9cc7a543cd76647ecc0d1d9a9067310e31\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/844685\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "8483352eef5b9101eec373284fce4a6ef634ed25",
      "tree": "8a97205ad9c4c11dd27a3410f64568ddfa54386f",
      "parents": [
        "96c6cf4f494a7c1bd2bd0ce0dd9a8caa7fa67121"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Oct 04 18:12:48 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu Oct 29 09:10:55 2026 -0700"
      },
      "message": "ssh: reject certificates with an empty principal list\n\nCheckCert skipped the principal check when ValidPrincipals was empty,\ntreating the certificate as valid for every user and every host. This\nfails open if a CA signs a certificate without principals by mistake,\nas happened in CVE-2024-7594. OpenSSH made the same change in 10.3\n(openssh-portable commit 5166b6cbf2b6), and now rejects such\ncertificates for user and host certificates alike.\n\nCheck the principal unconditionally, and reject a certificate without\nprincipals in SignCert as well. Verifiers older than OpenSSH 10.3 still\ntreat such a certificate as valid for every principal, and\nCVE-2024-7594 was a CA issuing them through SignCert. ssh-keygen only\nwarns when signing without -n, to keep generating them for tests, but\nSignCert has no way to warn. Callers that relied on certificates\nwithout principals, including ones issued by ssh-keygen without -n,\nhave to name the principals in the certificates they issue.\n\nChange-Id: Ia20609b6cecc6ffcdaa13fe7ec6015df563bcc62\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/844647\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "96c6cf4f494a7c1bd2bd0ce0dd9a8caa7fa67121",
      "tree": "6924794a247858a595ff162270e1de58840c0dea",
      "parents": [
        "1da6254a58cff58f9e77bb9e8fe3620317d4e7c8"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Oct 04 17:51:59 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu Oct 29 09:10:50 2026 -0700"
      },
      "message": "ssh: reject empty certificate principals\n\nCheckCert did not reject an empty principal, so a certificate that\nlists an empty principal was accepted for an empty user name or host\nname. Both can occur: the server accepts an empty user name, and an\naddress such as \":22\" has an empty host name.\n\nNever match an empty principal, and reject an empty entry in\nValidPrincipals in SignCert, as ssh-keygen does. A certificate holding\none still parses, as in OpenSSH, and its other principals still match.\n\nFixes golang/go#81539\n\nChange-Id: I9d33113c68dcd3f40914bf6de87613902542619e\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/844646\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "1da6254a58cff58f9e77bb9e8fe3620317d4e7c8",
      "tree": "be8bb3d6d82aed958f0cae98be4ed5910314d58c",
      "parents": [
        "19e424ee3413a6e5f9adcdf79a8678cdd70e7c5a"
      ],
      "author": {
        "name": "XiaolinZhao",
        "email": "zhaoxiaolin@loongson.cn",
        "time": "Thu Oct 08 20:14:24 2026 +0800"
      },
      "committer": {
        "name": "abner chenc",
        "email": "chenguoqi@loongson.cn",
        "time": "Mon Oct 26 17:53:12 2026 -0700"
      },
      "message": "Reland \"blake2s: add loong64 SIMD implementation\"\n\nThis relands CL 661215, which was reverted in CL 664796 because it\ndid not build on Go 1.23 or 1.24.\n\nThe minimum required Go version has been bumped to 1.26, so the\nbuild failure described in golang/go#73354 no longer applies.\n\nChange-Id: I0743ae82f94e3541b9eaf680f56dfc187ab4c118\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/846925\nReviewed-by: abner chenc \u003cchenguoqi@loongson.cn\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Meidan Li \u003climeidan@loongson.cn\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "19e424ee3413a6e5f9adcdf79a8678cdd70e7c5a",
      "tree": "c0fdaaf0bdf02897789c838833001e53885b04f6",
      "parents": [
        "9f2b28d4331a80cb1ffd8fd7f1cf6207b696281b"
      ],
      "author": {
        "name": "Mike Nolta",
        "email": "mike@nolta.net",
        "time": "Fri Oct 23 14:03:58 2026 -0400"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Oct 26 08:09:06 2026 -0700"
      },
      "message": "ssh/test: isolate TestSSHCLIControlClientConn from user SSH config\n\nCL 777900 added -F none and -o IdentityAgent\u003dnone to the ssh(1)\ninvocations in the CLI tests, but TestSSHCLIControlClientConn was added\nconcurrently by CL 733040 and missed the change. With a user\n~/.ssh/config that enables ControlPersist, the test hangs until it\ntimes out.\n\nApply the same flags to the control master invocation.\n\nUpdates golang/go#79411\n\nChange-Id: I3d68db33d7e0ed979a775871e832d36dca6fb5c6\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/853405\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "9f2b28d4331a80cb1ffd8fd7f1cf6207b696281b",
      "tree": "469a8cd5c8b714a9533ed086d473e47b58dfa0fa",
      "parents": [
        "664e25be82c6ffb5dc3cf010d8bdce44f2993a78"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue Oct 20 08:17:21 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Oct 20 08:33:06 2026 -0700"
      },
      "message": "x509roots/fallback: update bundle\n\nRemoves some roots which issued compromised intermediates.\n\nChange-Id: Iaa2da4d047d614f28673e46c2ee0b1b0657e057b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/851049\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "664e25be82c6ffb5dc3cf010d8bdce44f2993a78",
      "tree": "a4a51832f1fac1ed900cd1ba73308556d8fc2400",
      "parents": [
        "0ae6809b7559060fe62abe65e26bd18b1fcaf6b7"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue Oct 20 08:15:29 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Oct 20 08:33:02 2026 -0700"
      },
      "message": "x509roots: update certdata source URL\n\nUsing the mozilla mercurial source is fragile, because they do weird\nthings that sometimes result in the file not being available.\nAdditionally the mozilla-central repo has a lag in importing nss\nchanges.\n\nInstead, just use the github nss repo.\n\nChange-Id: I1894d930f4c7be4d6b0635ecc0969730b3270c72\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/851048\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "0ae6809b7559060fe62abe65e26bd18b1fcaf6b7",
      "tree": "4c47be45388d2d291c3cdcf7cc0cecc6f8e2fa43",
      "parents": [
        "cf169cd0986fa0e2e0963ee5f8d234885f869750"
      ],
      "author": {
        "name": "Will Mortensen",
        "email": "will@extrahop.com",
        "time": "Fri Sep 04 17:32:37 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Oct 16 08:13:42 2026 -0700"
      },
      "message": "ssh: remove channel.maxIncomingPayload\n\nSince CL 797061 it is always equal to channelMaxPacket, so remove it and\njust use channelMaxPacket.\n\n(Note that prior to that CL, the fact that maxIncomingPayload was zero\nfor undecided channels helpfully prevented the mux from buffering\nincoming payload data on them. Between that CL and CL 826504, it would\nincorrectly buffer such data.)\n\nChange-Id: I6c8c4203f0fd758927c6d8e03dc04f9d3b3430dc\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/828064\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "cf169cd0986fa0e2e0963ee5f8d234885f869750",
      "tree": "a4f5634194c7313e58d10033564c3dd4e27015ec",
      "parents": [
        "3b414e3e8284a71c817c4d1009acdd5d3a464ff9"
      ],
      "author": {
        "name": "nnnkkk7",
        "email": "kurodanaoki0711pana@gmail.com",
        "time": "Mon Oct 12 23:28:07 2026 +0900"
      },
      "committer": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Wed Oct 14 13:12:58 2026 -0700"
      },
      "message": "ssh/terminal: add //go:fix inline directives\n\nThe package is deprecated in favor of golang.org/x/term, and its\ntypes and functions only forward to x/term. Add //go:fix inline\ndirectives so that go fix can rewrite callers to use x/term directly,\nas was done for golang.org/x/net/context.\n\nErrPasteIndicator is a variable, which cannot be inlined, so it is\nleft unannotated.\n\nFixes golang/go#82160\n\nChange-Id: I07b8f5dfe1a0f8a57e31af3798ce764ed06941e3\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/848765\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n"
    },
    {
      "commit": "3b414e3e8284a71c817c4d1009acdd5d3a464ff9",
      "tree": "ce3257c818a29ea9a0025c5acf08df2824f77cec",
      "parents": [
        "99e4382b128eecca08735c9604400ba7260a4cdf"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Oct 04 18:32:40 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Oct 11 12:51:43 2026 -0700"
      },
      "message": "ssh: accept trailing data in USERAUTH_BANNER messages\n\nSome servers send banner messages with trailing bytes after the\nlanguage tag. OpenSSH does not check for trailing data when parsing\nthe banner, while we fail the handshake with \"parse error in message\ntype 53\".\n\nIgnore trailing data so that the banner is still delivered to the\nBannerCallback. Truncated banners are still rejected, as in OpenSSH.\n\nFixes golang/go#81647\n\nChange-Id: Ib605f0fc4b77af5dadc45c5df112e2feb0b40698\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/844665\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "99e4382b128eecca08735c9604400ba7260a4cdf",
      "tree": "4a2e20b59b8c0ff388f2459cda0d2f4db7555733",
      "parents": [
        "270e669ca632658524800dc316fe4b73aba4d2e6"
      ],
      "author": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Thu Oct 08 22:12:02 2026 +0100"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Oct 09 13:08:56 2026 -0700"
      },
      "message": "openpgp: delete module\n\nFixes golang/go#81227\n\nChange-Id: Ifab64488fe7f9330eb8aa5b05efef7186a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/847567\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "270e669ca632658524800dc316fe4b73aba4d2e6",
      "tree": "d0717c93b6c44e07c3012d8790dfdda50322be55",
      "parents": [
        "c623b6c37b797257fbdce67b09d07f2c2a1c11a5"
      ],
      "author": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Fri Oct 09 19:30:00 2026 +0100"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Oct 09 12:33:23 2026 -0700"
      },
      "message": "openpgp: tidy module\n\nFixes golang/go#81227\n\nChange-Id: I5d1bc866d0b929a7fa9384caf62e2f756a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/848225\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "c623b6c37b797257fbdce67b09d07f2c2a1c11a5",
      "tree": "5576f720b422f303a471747b73d5424e2f7c8c55",
      "parents": [
        "2f1f834330b2d36ab3db8bfb33aaa1ac16794588"
      ],
      "author": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Fri Oct 09 18:25:19 2026 +0100"
      },
      "committer": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Fri Oct 09 11:22:49 2026 -0700"
      },
      "message": "openpgp: make carved out openpgp module fetchable\n\nFor golang/go#81227\n\nChange-Id: I2a1b00794de7e70b3131a9c4f2efd6106a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/848205\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nTryBot-Bypass: Sean Liao \u003csean@liao.dev\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "2f1f834330b2d36ab3db8bfb33aaa1ac16794588",
      "tree": "d2aa3c8436d5df36eea7e4a792dfd5447ca8f2fb",
      "parents": [
        "8fdf07b3114278fb3b78c1cf1814e08bd851eb4c"
      ],
      "author": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Thu Oct 08 22:10:23 2026 +0100"
      },
      "committer": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Fri Oct 09 11:17:18 2026 -0700"
      },
      "message": "openpgp: carve out openpgp as a module\n\nMirror the GO-2026-5932 vulnerability report in the deprecation notice.\n\nFor golang/go#81227\n\nChange-Id: I410f63cdd54815118b70bfd43966e8646a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/847566\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nTryBot-Bypass: Sean Liao \u003csean@liao.dev\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\n"
    },
    {
      "commit": "8fdf07b3114278fb3b78c1cf1814e08bd851eb4c",
      "tree": "1b714de3bf4514ee403d15e3deed5c280a11dffd",
      "parents": [
        "2437861a30358e949c7be3c9f876233fd28c20fe"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Oct 09 09:11:51 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Oct 09 09:24:17 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Iaf40b5a7c231debd3cdf0b4ae0551a9602393a9b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/848105\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "2437861a30358e949c7be3c9f876233fd28c20fe",
      "tree": "822ffa54ff184402ca3386ed9c0452103c6e8a49",
      "parents": [
        "c3db4df58582058384d318c87f1c912848d8c464"
      ],
      "author": {
        "name": "XiaolinZhao",
        "email": "zhaoxiaolin@loongson.cn",
        "time": "Thu Oct 08 10:13:18 2026 +0800"
      },
      "committer": {
        "name": "abner chenc",
        "email": "chenguoqi@loongson.cn",
        "time": "Thu Oct 08 17:58:02 2026 -0700"
      },
      "message": "salsa20: fix keystream reuse in LoongArch LSX tail\n\nThe LoongArch assembly\u0027s \u003c256-byte tail path (less_than_256) consumed\nkeystream vectors V0-V15 that had already been fully used by the\npreceding 256-byte iteration, instead of generating fresh blocks. As a\nresult, for lengths such as 257, byte 256 was XORed with the same\nkeystream word as byte 0.\n\nJump back to loop256 for the tail so a fresh 4-block keystream is\ngenerated with the already-advanced counter before the tail branches\nconsume it.\n\nAdd TestUnalignedLengths to compare the assembly implementation\nagainst genericXORKeyStream over all lengths, covering every tail\nbranch with and without a preceding full 256-byte iteration.\n\nFixes golang/go#81939\n\nChange-Id: I0334fc277189b198067a365bd1e51bdf98cb8e9a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/846805\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: abner chenc \u003cchenguoqi@loongson.cn\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "c3db4df58582058384d318c87f1c912848d8c464",
      "tree": "ef133780ed6c08b3a135da50857d59b4ec9cf416",
      "parents": [
        "4e01a8447cadd21a75969d3db82ba6191202cebc"
      ],
      "author": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Fri Oct 02 16:04:26 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Oct 05 11:52:13 2026 -0700"
      },
      "message": "acme: prefer test log helpers in test contexts\n\nStandard Go practice is to use t.Logf() and t.Log() over log.Printf()\nand log.Print when we have a t handy. This helps keep the output\nassociated with the specific test case.\n\nChange-Id: I15148c0430ecc3624aae8e70eced9df2d82b4b8e\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/843925\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "4e01a8447cadd21a75969d3db82ba6191202cebc",
      "tree": "4df39e3f096865b0c18dafb3a404affe9b641b43",
      "parents": [
        "8f0f1112abdbc13b6e53068b813cc327e40f2f9f"
      ],
      "author": {
        "name": "Ian Stapleton Cordasco",
        "email": "graffatcolmingov@gmail.com",
        "time": "Sun Mar 30 21:02:23 2025 -0500"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Oct 05 09:30:50 2026 -0700"
      },
      "message": "acme: adds support for profiles draft\n\nLet\u0027s Encrypt is already supporting Profiles in requests made to the\nnew-order endpoint and returning them in the meta field of the directory.\nThis parses those and adds a new OrderOption to enable specifying this\nwhen constructing the new order request via AuthorizeOrder.\n\nWhen profiles are not supported, this returns an error early. When the\nspecified profile name is not in the list of specified profiles, an\nerror is returned early.\n\nFixes golang/go#73101\n\nCo-authored-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nChange-Id: Idc7d0a6908d970d96a9c2b6097e849be22d9054f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/843885\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "8f0f1112abdbc13b6e53068b813cc327e40f2f9f",
      "tree": "d3fef89c434501b22afd5106646d65c320639b30",
      "parents": [
        "b39ff6d641ecc5bb4b241737cb0c6b646f3e12a9"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Aug 30 21:33:44 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Sun Oct 04 05:11:23 2026 -0700"
      },
      "message": "ssh: check that no Unicode-aware string function is used\n\nThe SSH protocol, and the file formats that come with it, are byte\noriented. Folding case or trimming space by Unicode rules makes a parser\naccept an entry that its peers reject, or read a field as ending where\nthey do not, which is how the known_hosts parsers here came to disagree\nwith each other and with OpenSSH.\n\nAdd a test walking the source of ssh and of the packages under it, and\nrejecting a call to a strings or bytes function that decides on its own\nwhat whitespace or what case is, as net/http does for the same reason.\nAn explicit cutset, as in bytes.Trim(b, \" \\t\"), stays allowed. A doc\ncomment that named one of those functions is reworded, since the test\nmatches comments too.\n\nChange-Id: I4482a16632bd50b8dd8fc3f158da6da36ac44f03\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/832728\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Mark Freeman \u003cmark@golang.org\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\n"
    },
    {
      "commit": "b39ff6d641ecc5bb4b241737cb0c6b646f3e12a9",
      "tree": "315b8ab0898e710318886764709250f35129f45b",
      "parents": [
        "4465db3225a5d7b6f86e015ad0a10ab81342aca1"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Sep 14 09:52:32 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Sep 29 10:25:09 2026 -0700"
      },
      "message": "ssh: add certificate algorithms for ML-DSA keys\n\nAdd ssh-mldsa-44-cert-v01@golang.org, ssh-mldsa-65-cert-v01@golang.org\nand ssh-mldsa-87-cert-v01@golang.org, certifying the keys of the\ncorresponding ML-DSA public key algorithms. No specification defines a\ncertificate algorithm for ML-DSA, hence the vendor names, as per\nRFC 4251, Section 4.2. The certificate format is that of\ndraft-ietf-sshm-cert-01, with the public key fields holding the key as\nencoded by draft-sfluhrer-ssh-mldsa-08, Section 4: a single string of\nfixed length.\n\nLike the plain algorithms, they require Go 1.27 and are negotiated by\ndefault at the end of the host key preference list.\n\nThe agent protocol can list, sign with and authenticate with ML-DSA keys\nand certificates held by a Keyring, since those operations only carry\npublic keys and signatures. Adding them through the protocol is left\nout, with the private key format of the plain algorithms: no private\ncertificate format is defined. When one is, the private key fields\nshould be the 32-byte seed.\n\nChange-Id: Id0b7da49e532e57af2c765f7f2e71141f763d7b4\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/828364\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Mark Freeman \u003cmark@golang.org\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n"
    },
    {
      "commit": "4465db3225a5d7b6f86e015ad0a10ab81342aca1",
      "tree": "12d84f46ec39ef524b3b7ba84e53bb6a1c167577",
      "parents": [
        "83e695bb1a7ac85613745a2544464f652ddcffcf"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Aug 23 20:25:11 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Sep 29 10:25:02 2026 -0700"
      },
      "message": "ssh: add the ML-DSA public key algorithms\n\nImplement ssh-mldsa-44, ssh-mldsa-65 and ssh-mldsa-87 from\ndraft-sfluhrer-ssh-mldsa-08, for host keys and public key authentication.\nThe names are registered in the IANA \"Public Key Algorithm Names\"\nregistry. They require Go 1.27 and come last in the preference lists,\nso that adding an ML-DSA host key to a server doesn\u0027t change the host\nkey its clients already know.\n\nThe wire format is verified against the ML-DSA-65 test key of PKIX-SSH,\nthe only other implementation of the draft, which uses the same names\nsince its commit e035f40b.\n\nCertificates are left out, since no certificate algorithm is defined for\nML-DSA keys. ML-DSA keys can still sign certificates.\n\nPrivate key files are left out too: the draft, Section 5, declares the\nprivate key format out of scope, and no implementation defines an\nOpenSSH one. Keys in the PKCS #8 seed-only form are supported through\ncrypto/x509, and are the only portable form: Go writes them, and\nOpenSSL based implementations read them. Keys written by OpenSSL in its\ndefault form, with both seed and expanded key, must be converted to\nseed-only first.\n\nChange-Id: I6915911c60a7e0c155942aefb4c4d76198e0185e\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/819920\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "83e695bb1a7ac85613745a2544464f652ddcffcf",
      "tree": "3752b57bd1dacc121b98dc0342243a5ccede9928",
      "parents": [
        "946083a5fb28da882ed9fa6eb561e000f47e3ee7"
      ],
      "author": {
        "name": "Nicola",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Aug 18 10:45:14 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Sep 29 09:51:04 2026 -0700"
      },
      "message": "ssh: implement ETM mode for CBC ciphers\n\nThe *-etm@openssh.com MAC algorithms require the packet length to be\nsent unencrypted and the MAC to be computed over the ciphertext. Only\nstreamPacketCipher implemented this, cbcCipher ignored the negotiated\nmode and always encrypted the length and MAC\u0027d the plaintext, so a CBC\ncipher combined with an EtM MAC only worked against another Go peer.\n\nFixes golang/go#64779\n\nChange-Id: I110c1bcaaf075d858c70ba87b070f1d5718ecf4c\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/552495\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Mark Freeman \u003cmark@golang.org\u003e\n"
    },
    {
      "commit": "946083a5fb28da882ed9fa6eb561e000f47e3ee7",
      "tree": "df9904a394c786be3aeb4c5881beeb57aa675fad",
      "parents": [
        "543dde943b04b875f2220324e0e9881be7d0092d"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Aug 30 21:28:42 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Sep 29 09:16:56 2026 -0700"
      },
      "message": "ssh: only drop a trailing carriage return\n\nParseKnownHosts and ParseAuthorizedKey ended the line at the first carriage\nreturn anywhere in it, so an entry whose host name held one lost the rest\nof the line and was skipped without an error, while ssh/knownhosts read the\nsame entry as a host name holding a carriage return, and registered it.\n\nOpenSSH ends the line at the first \u0027\\n\u0027 and keeps every carriage return, so\none inside a field is part of that field. Keep those, and drop a single\ntrailing one, which is what bufio.ScanLines already does for ssh/knownhosts,\nso that both parsers read a file with CRLF line endings the same way.\n\nChange-Id: I9ba8508b02b3272a26b7b074a961956085baca8f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/832727\nReviewed-by: Mark Freeman \u003cmark@golang.org\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "543dde943b04b875f2220324e0e9881be7d0092d",
      "tree": "56816ea99579e1196303b2f01157caf762f0d02a",
      "parents": [
        "15671268a446718a52a2f34a186cdcb91147134c"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Aug 30 20:40:02 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Sep 29 09:16:43 2026 -0700"
      },
      "message": "ssh: accept known_hosts entries with a multi-word comment\n\nParseKnownHosts rejected an entry holding more than five fields, so a\ncomment longer than two words, or longer than one word behind a marker,\nwas an error, while ssh/knownhosts and OpenSSH both accept it.\n\nChange-Id: Ibf8a804a4957d320ac9bd6ebf47c86787a7b0f49\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/832726\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Mark Freeman \u003cmark@golang.org\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "15671268a446718a52a2f34a186cdcb91147134c",
      "tree": "ef399f02dc27c08879a2ee8fc13ffb40a835109b",
      "parents": [
        "7a4a4d6beae2222add4437a0910bd48414e19211"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Aug 25 11:38:32 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Sep 29 09:16:34 2026 -0700"
      },
      "message": "ssh: treat only ASCII space and tab as whitespace\n\nParseKnownHosts split and trimmed the entry with bytes.Fields and\nbytes.TrimSpace, both of which are Unicode aware, so it disagreed with\nssh/knownhosts on where a field ends: since CL 782426 that package trims\nASCII space and tab only.\n\nOpenSSH\u0027s hostkeys_foreach_file and sshkey_read delimit every field with\n\u0027 \u0027 and \u0027\\t\u0027 alone, so any other Unicode space character is part of the\nfield. Match that here, in parseAuthorizedKey, which receives the key\nfield from ParseKnownHosts, and in ParseAuthorizedKey, whose line sshd\nskips with skip_space.\n\nLeading whitespace that is not ASCII is no longer trimmed, so an entry\nstarting with a no-break space followed by \u0027#\u0027 is now a host pattern\nrather than a comment, as it is for OpenSSH and for ssh/knownhosts.\n\nChange-Id: I942165fb94529dad7179ccb121ea345a5a16c3e1\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/832724\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Mark Freeman \u003cmark@golang.org\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "7a4a4d6beae2222add4437a0910bd48414e19211",
      "tree": "c1c1de907402c6e3852fce50c931e2b15ea1fcbc",
      "parents": [
        "1f7c531b64a19f04f56ccc318130688c5ba0aa51"
      ],
      "author": {
        "name": "Xiaolin Zhao",
        "email": "zhaoxiaolin@loongson.cn",
        "time": "Mon Jun 23 11:16:45 2025 +0800"
      },
      "committer": {
        "name": "abner chenc",
        "email": "chenguoqi@loongson.cn",
        "time": "Mon Sep 21 00:02:45 2026 -0700"
      },
      "message": "salsa20: add loong64 SIMD implementation\n\nBenchmark results on Loongson-3C6000 @ 2.20GHz:\n\ngoos: linux\ngoarch: loong64\npkg: golang.org/x/crypto/salsa20\ncpu: Loongson-3C6000/S @ 2200.00MHz\n      |  old.bench   |              new.bench              |\n      |    sec/op    |   sec/op     vs base                |\nXOR1K   3835.5n ± 0%   493.9n ± 0%  -87.12% (p\u003d0.000 n\u003d10)\n\n      |  old.bench   |               new.bench                |\n      |     B/s      |      B/s       vs base                 |\nXOR1K   254.6Mi ± 0%   1977.4Mi ± 0%  +676.64% (p\u003d0.000 n\u003d10)\n\nChange-Id: I9f795e7f4e2c467ba9a41c9e6f460612536021ba\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/683255\nReviewed-by: abner chenc \u003cchenguoqi@loongson.cn\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "1f7c531b64a19f04f56ccc318130688c5ba0aa51",
      "tree": "daff747de6c4bc4a8bd51d11230569af9d3ad46e",
      "parents": [
        "234d0b5a5f76653159d274d0e7750a994c39dc84"
      ],
      "author": {
        "name": "Xiaolin Zhao",
        "email": "zhaoxiaolin@loongson.cn",
        "time": "Fri Mar 21 10:54:57 2025 +0800"
      },
      "committer": {
        "name": "abner chenc",
        "email": "chenguoqi@loongson.cn",
        "time": "Sat Sep 19 18:40:00 2026 -0700"
      },
      "message": "blake2b: add loong64 SIMD implementation\n\nBenchmark results on Loongson-3C6000 @ 2.20GHz:\n\ngoos: linux\ngoarch: loong64\npkg: golang.org/x/crypto/blake2b\ncpu: Loongson-3C6000/S @ 2200.00MHz\n         |  old.bench  |              new.bench              |\n         |   sec/op    |   sec/op     vs base                |\nWrite128   350.0n ± 0%   178.3n ± 0%  -49.06% (p\u003d0.000 n\u003d10)\nWrite1K    2.687µ ± 0%   1.286µ ± 0%  -52.14% (p\u003d0.000 n\u003d10)\nSum128     362.6n ± 0%   183.7n ± 0%  -49.34% (p\u003d0.000 n\u003d10)\nSum1K      2.788µ ± 0%   1.295µ ± 0%  -53.54% (p\u003d0.000 n\u003d10)\ngeomean    987.4n        483.3n       -51.06%\n\n         |  old.bench   |               new.bench               |\n         |     B/s      |     B/s       vs base                 |\nWrite128   348.8Mi ± 0%   684.8Mi ± 0%   +96.31% (p\u003d0.000 n\u003d10)\nWrite1K    363.5Mi ± 0%   759.6Mi ± 0%  +108.99% (p\u003d0.000 n\u003d10)\nSum128     336.6Mi ± 0%   664.4Mi ± 0%   +97.37% (p\u003d0.000 n\u003d10)\nSum1K      350.3Mi ± 0%   754.0Mi ± 0%  +115.23% (p\u003d0.000 n\u003d10)\ngeomean    349.7Mi        714.5Mi       +104.32%\n\nChange-Id: I181a0284c5913cca34f074466f7d83439554e450\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/659775\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: abner chenc \u003cchenguoqi@loongson.cn\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n"
    },
    {
      "commit": "234d0b5a5f76653159d274d0e7750a994c39dc84",
      "tree": "1a5fe00daef5177aad37259c26d92db7c83a2956",
      "parents": [
        "a083cb74b68c74fcf1262b6961ac57a6e3b37389"
      ],
      "author": {
        "name": "Xiaolin Zhao",
        "email": "zhaoxiaolin@loongson.cn",
        "time": "Mon Jun 23 11:28:29 2025 +0800"
      },
      "committer": {
        "name": "abner chenc",
        "email": "chenguoqi@loongson.cn",
        "time": "Sat Sep 19 18:39:20 2026 -0700"
      },
      "message": "chacha20: add loong64 SIMD implementation\n\nAdd an assembly implementation of ChaCha20 for Loong64 using LSX SIMD\ninstructions. This significantly improves performance across all message\nsizes on LoongArch machines.\n\nBenchmark results on Loongson-3C6000 @ 2.20GHz:\n\ngoos: linux\ngoarch: loong64\npkg: golang.org/x/crypto/chacha20\ncpu: Loongson-3C6000/S @ 2200.00MHz\n                 │  old.bench   │              new.bench              │\n                 │    sec/op    │   sec/op     vs base                │\nChaCha20/64         188.4n ± 0%   156.9n ± 0%  -16.72% (p\u003d0.000 n\u003d10)\nChaCha20/256        666.4n ± 0%   151.5n ± 0%  -77.27% (p\u003d0.000 n\u003d10)\nChaCha20/10x25     1037.0n ± 0%   578.9n ± 0%  -44.18% (p\u003d0.000 n\u003d10)\nChaCha20/4096      10.207µ ± 0%   1.955µ ± 0%  -80.85% (p\u003d0.000 n\u003d10)\nChaCha20/100x40    11.856µ ± 0%   5.785µ ± 0%  -51.21% (p\u003d0.000 n\u003d10)\nChaCha20/65536     162.99µ ± 0%   31.60µ ± 0%  -80.61% (p\u003d0.000 n\u003d10)\nChaCha20/1000x65   165.57µ ± 0%   41.93µ ± 0%  -74.67% (p\u003d0.000 n\u003d10)\ngeomean             6.369µ        2.141µ       -66.38%\n\n                 │  old.bench   │               new.bench                │\n                 │     B/s      │      B/s       vs base                 │\nChaCha20/64        323.9Mi ± 0%    389.0Mi ± 0%   +20.10% (p\u003d0.000 n\u003d10)\nChaCha20/256       366.4Mi ± 0%   1611.2Mi ± 0%  +339.80% (p\u003d0.000 n\u003d10)\nChaCha20/10x25     229.8Mi ± 0%    411.8Mi ± 0%   +79.19% (p\u003d0.000 n\u003d10)\nChaCha20/4096      382.7Mi ± 0%   1998.1Mi ± 0%  +422.08% (p\u003d0.000 n\u003d10)\nChaCha20/100x40    321.8Mi ± 0%    659.4Mi ± 0%  +104.94% (p\u003d0.000 n\u003d10)\nChaCha20/65536     383.5Mi ± 0%   1977.8Mi ± 0%  +415.78% (p\u003d0.000 n\u003d10)\nChaCha20/1000x65   374.4Mi ± 0%   1478.4Mi ± 0%  +294.86% (p\u003d0.000 n\u003d10)\ngeomean            335.9Mi         999.2Mi       +197.50%\n\nChange-Id: I6b8d243819d0ab1a1d6540648ed9bd00ecad5a2e\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/683196\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: abner chenc \u003cchenguoqi@loongson.cn\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n"
    },
    {
      "commit": "a083cb74b68c74fcf1262b6961ac57a6e3b37389",
      "tree": "5b4a193428aaa5fac0289c320ec03f17932b8f21",
      "parents": [
        "b4dcfb54b86352ed9dcb821f5db3ee7922583434"
      ],
      "author": {
        "name": "XiaolinZhao",
        "email": "zhaoxiaolin@loongson.cn",
        "time": "Wed Sep 02 15:34:30 2026 +0800"
      },
      "committer": {
        "name": "abner chenc",
        "email": "chenguoqi@loongson.cn",
        "time": "Sat Sep 19 18:38:21 2026 -0700"
      },
      "message": "argon2: add loong64 LSX implementation of blamka\n\nBenchmark results on Loongson-3C6000 @ 2.20GHz:\n\ngoos: linux\ngoarch: loong64\npkg: golang.org/x/crypto/argon2\ncpu: Loongson-3C6000/S @ 2200.00MHz\n                                             |  old.bench   |              new.bench              |\n                                             |    sec/op    |   sec/op     vs base                |\nArgon2i/_Time:_3_Memory:_32_MB,_Threads:_1     123.36m ± 0%   76.67m ± 0%  -37.85% (p\u003d0.000 n\u003d10)\nArgon2i/_Time:_4_Memory:_32_MB,_Threads:_1      163.7m ± 0%   101.3m ± 0%  -38.09% (p\u003d0.000 n\u003d10)\nArgon2i/_Time:_5_Memory:_32_MB,_Threads:_1      195.0m ± 0%   116.5m ± 8%  -40.24% (p\u003d0.000 n\u003d10)\nArgon2i/_Time:_3_Memory:_64_MB,_Threads:_4      259.4m ± 0%   165.3m ± 0%  -36.28% (p\u003d0.000 n\u003d10)\nArgon2i/_Time:_4_Memory:_64_MB,_Threads:_4      349.9m ± 0%   220.8m ± 0%  -36.92% (p\u003d0.000 n\u003d10)\nArgon2i/_Time:_5_Memory:_64_MB,_Threads:_4      437.6m ± 0%   276.0m ± 0%  -36.92% (p\u003d0.000 n\u003d10)\nArgon2d/_Time:_3,_Memory:_32_MB,_Threads:_1    116.34m ± 0%   72.07m ± 0%  -38.06% (p\u003d0.000 n\u003d10)\nArgon2d/_Time:_4,_Memory:_32_MB,_Threads:_1    154.42m ± 0%   95.28m ± 0%  -38.30% (p\u003d0.000 n\u003d10)\nArgon2d/_Time:_5,_Memory:_32_MB,_Threads:_1     192.4m ± 0%   115.9m ± 2%  -39.73% (p\u003d0.000 n\u003d10)\nArgon2d/_Time:_3,_Memory:_64_MB,_Threads:_4     254.4m ± 0%   165.2m ± 0%  -35.06% (p\u003d0.000 n\u003d10)\nArgon2d/_Time:_4,_Memory:_64_MB,_Threads:_4     345.5m ± 1%   221.0m ± 0%  -36.04% (p\u003d0.000 n\u003d10)\nArgon2d/_Time:_5,_Memory:_64_MB,_Threads:_4     432.1m ± 0%   276.2m ± 0%  -36.09% (p\u003d0.000 n\u003d10)\nArgon2id/_Time:_3,_Memory:_32_MB,_Threads:_1   116.49m ± 0%   72.38m ± 0%  -37.86% (p\u003d0.000 n\u003d10)\nArgon2id/_Time:_4,_Memory:_32_MB,_Threads:_1   154.59m ± 0%   95.71m ± 3%  -38.09% (p\u003d0.000 n\u003d10)\nArgon2id/_Time:_5,_Memory:_32_MB,_Threads:_1    192.5m ± 0%   115.0m ± 0%  -40.25% (p\u003d0.000 n\u003d10)\nArgon2id/_Time:_3,_Memory:_64_MB,_Threads:_4    255.6m ± 0%   165.7m ± 0%  -35.18% (p\u003d0.000 n\u003d10)\nArgon2id/_Time:_4,_Memory:_64_MB,_Threads:_4    345.4m ± 0%   221.5m ± 0%  -35.87% (p\u003d0.000 n\u003d10)\nArgon2id/_Time:_5,_Memory:_64_MB,_Threads:_4    431.9m ± 0%   276.6m ± 0%  -35.96% (p\u003d0.000 n\u003d10)\ngeomean                                         227.7m        142.6m       -37.40%\n\n                                             |  old.bench   |               new.bench               |\n                                             |     B/op     |     B/op      vs base                 |\nArgon2i/_Time:_3_Memory:_32_MB,_Threads:_1     32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_4_Memory:_32_MB,_Threads:_1     32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_5_Memory:_32_MB,_Threads:_1     32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_3_Memory:_64_MB,_Threads:_4     64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_4_Memory:_64_MB,_Threads:_4     64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_5_Memory:_64_MB,_Threads:_4     64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_3,_Memory:_32_MB,_Threads:_1    32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_4,_Memory:_32_MB,_Threads:_1    32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_5,_Memory:_32_MB,_Threads:_1    32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_3,_Memory:_64_MB,_Threads:_4    64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_4,_Memory:_64_MB,_Threads:_4    64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_5,_Memory:_64_MB,_Threads:_4    64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_3,_Memory:_32_MB,_Threads:_1   32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_4,_Memory:_32_MB,_Threads:_1   32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_5,_Memory:_32_MB,_Threads:_1   32.00Mi ± 0%   32.00Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_3,_Memory:_64_MB,_Threads:_4   64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_4,_Memory:_64_MB,_Threads:_4   64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_5,_Memory:_64_MB,_Threads:_4   64.01Mi ± 0%   64.01Mi ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\ngeomean                                        45.26Mi        45.26Mi       +0.00%\n¹ all samples are equal\n\n                                             | old.bench  |              new.bench              |\n                                             | allocs/op  | allocs/op   vs base                 |\nArgon2i/_Time:_3_Memory:_32_MB,_Threads:_1     31.00 ± 0%   31.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_4_Memory:_32_MB,_Threads:_1     39.00 ± 0%   39.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_5_Memory:_32_MB,_Threads:_1     47.00 ± 0%   47.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_3_Memory:_64_MB,_Threads:_4     73.00 ± 0%   73.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_4_Memory:_64_MB,_Threads:_4     93.00 ± 0%   93.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2i/_Time:_5_Memory:_64_MB,_Threads:_4     113.0 ± 0%   113.0 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_3,_Memory:_32_MB,_Threads:_1    31.00 ± 0%   31.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_4,_Memory:_32_MB,_Threads:_1    39.00 ± 0%   39.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_5,_Memory:_32_MB,_Threads:_1    47.00 ± 0%   47.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_3,_Memory:_64_MB,_Threads:_4    73.00 ± 0%   73.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_4,_Memory:_64_MB,_Threads:_4    93.00 ± 0%   93.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2d/_Time:_5,_Memory:_64_MB,_Threads:_4    113.0 ± 0%   113.0 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_3,_Memory:_32_MB,_Threads:_1   31.00 ± 0%   31.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_4,_Memory:_32_MB,_Threads:_1   39.00 ± 0%   39.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_5,_Memory:_32_MB,_Threads:_1   47.00 ± 0%   47.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_3,_Memory:_64_MB,_Threads:_4   73.00 ± 0%   73.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_4,_Memory:_64_MB,_Threads:_4   93.00 ± 0%   93.00 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\nArgon2id/_Time:_5,_Memory:_64_MB,_Threads:_4   113.0 ± 0%   113.0 ± 0%       ~ (p\u003d1.000 n\u003d10) ¹\ngeomean                                        59.32        59.32       +0.00%\n¹ all samples are equal\n\nChange-Id: Ia814057ddfdefbe1d23431fa366189ffe5852b96\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/826304\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: abner chenc \u003cchenguoqi@loongson.cn\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n"
    },
    {
      "commit": "b4dcfb54b86352ed9dcb821f5db3ee7922583434",
      "tree": "33dca39d25b41e4bf1785a4067dbc4bf1424e1a3",
      "parents": [
        "b853e4b620cd9d53ff69e7513aa132a5f0a195a2"
      ],
      "author": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Tue Aug 18 11:08:46 2026 -0400"
      },
      "committer": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Fri Sep 18 12:05:15 2026 -0700"
      },
      "message": "acme: support standards-compliant order finalization\n\nWhen an order finalization response is not immediately valid,\nClient.CreateOrderCert depends on the ACME server returning a Location\nheader. The header value is used as the URL for polling the updated\norder status. RFC 8555 does not require this header, so CreateOrderCert\ndoes not interoperate with ACME servers that omit it (e.g. Pebble\nv2.9.0+).\n\nThis commit adds Client.CreateCertFromOrder, which accepts an *Order and\nuses its URI for polling instead of relying on the finalization\nresponse\u0027s Location header. It also updates existing callers and\ndocumentation to use the new method and updates the integration tests to\nPebble v2.10.1 (the latest available version), which omits the\nfinalization Location header.\n\nFixes golang/go#77704\n\nChange-Id: I0852f19c5d18d6debc9c9686fa2c14a2e39663c2\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/817000\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "b853e4b620cd9d53ff69e7513aa132a5f0a195a2",
      "tree": "4cfa9c52a464efcaa974dea964dd9fa52a75b56f",
      "parents": [
        "3f62bf119e84c6e35e8518a2958089ade622d1a3"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Sep 16 15:31:03 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Sep 16 08:43:51 2026 -0700"
      },
      "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: I975f934aabe6eaf6b9f256db2b6942c45c9bd7b4\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/833664\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "3f62bf119e84c6e35e8518a2958089ade622d1a3",
      "tree": "49fee6e8ff0077ff732305ba31f4855da81a54a5",
      "parents": [
        "86efde54dc7069251a8b007026c500d28e4239ce"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 08 10:00:27 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 08 11:05:01 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I39f495ef42016b2ab0c91f54b792ac16b967006f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/829324\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n"
    },
    {
      "commit": "86efde54dc7069251a8b007026c500d28e4239ce",
      "tree": "79b1942707885af0952436981fa447db1923cb71",
      "parents": [
        "a6cdac60840750226b15617ac8858be44361b36b"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sat Jun 13 11:48:20 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Sep 02 11:02:47 2026 -0700"
      },
      "message": "ssh: reject unexpected message types on established channels\n\nch.msg is only read while the channel open or a channel request with a\nreply is pending, so anything the default arm of channel.handlePacket\ndelivered to it was never consumed. The blocking send there let a\nmisbehaving peer fill the buffer with well-formed but unexpected message\ntypes carrying a valid channel id and stall the mux read loop,\ndeadlocking the whole connection.\n\nNo conforming peer sends such messages during the connection protocol.\nTreat them as a protocol error and tear the connection down, as\nhandleUnknownChannelPacket already does for the same messages when the\nchannel id is not in use.\n\nFixes CVE-2026-56855\nFixes golang/go#81317\n\nChange-Id: I87420dfe68fcb62a17df4b47dc5ffb6ccd72ba26\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/826524\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "a6cdac60840750226b15617ac8858be44361b36b",
      "tree": "7c6031eb50eaff92a212cb61375c829897810e98",
      "parents": [
        "39dc44e69c280a6254fa09ce85477455efeaf6a2"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sat Jun 13 11:54:07 2026 +0200"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Wed Sep 02 10:48:31 2026 -0700"
      },
      "message": "ssh: drop traffic on undecided channels\n\nA channel in the mux\u0027s chanList is not usable until it is established:\nan outbound channel has no confirmed remote id until the peer\u0027s open\nconfirmation, and an inbound channel is not serviced by the application\nuntil it is accepted. handlePacket processed any channel message on it,\nso a misbehaving peer could flood channel requests and block the mux\nread loop on the send to incomingRequests, deadlocking the connection,\nor close an outbound channel before confirming it, making the victim\ntear down a half-initialized channel and emit a close for remote id 0,\nan unrelated channel of the peer.\n\nNo such packet can be legitimate: the peer learns an inbound channel\u0027s\nlocal id only from the confirmation we have not sent yet, and on an\noutbound channel RFC 4254 lets it answer the open request only with a\nconfirmation or a failure.\n\nAdd an established flag, set when the channel becomes usable: for an\noutbound channel when the open response is received, for an inbound\nchannel by Accept before the confirmation is sent. Until then\nhandlePacket drops every packet other than the open response. The flag\nis separate from decided, which Reject also sets: a rejected channel is\ndecided but must never carry traffic.\n\nFixes CVE-2026-78662\nFixes golang/go#81316\n\nChange-Id: Ib0983bb216a49808a2db1f4a4d92ee9fe38a3c51\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/826504\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "39dc44e69c280a6254fa09ce85477455efeaf6a2",
      "tree": "b8090bdd416e0e3b4385a472def9f4db670f028d",
      "parents": [
        "afebf4cb4efb2b854282e03160da67120707f8f7"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Aug 18 10:22:35 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Sun Aug 30 20:04:51 2026 -0700"
      },
      "message": "ssh: don\u0027t skip the source-address critical option in CheckCert\n\nCertChecker.CheckCert ignored source-address on the assumption that\nserverAuthenticate would enforce it, but that only happens in the\nserver-side user authentication path. Nothing enforced it in the host key\npath, so CheckHostKey accepted CA-signed host certificates carrying\nsource-address regardless of the server\u0027s address, and the same applied to\napplications calling CheckCert directly.\n\nDrop the special case: every critical option must be listed in\nSupportedCriticalOptions, host and user certificates alike. Authenticate,\nthe only path where serverAuthenticate does enforce source-address, checks\nagainst a copy of the CertChecker with that option appended.\n\nFixes golang/go#80872\n\nChange-Id: I3c3554b71ea2a4ce4b17696a9596b973b7d74b00\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/816840\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n"
    },
    {
      "commit": "afebf4cb4efb2b854282e03160da67120707f8f7",
      "tree": "ff7e46c92f5589eeaa4562aa60b35d63c5efd0a2",
      "parents": [
        "89f4e9bb5b38861a69b1b26890a6833138d35ace"
      ],
      "author": {
        "name": "Dmitri Shuralyov",
        "email": "dmitshur@golang.org",
        "time": "Fri May 08 11:37:29 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 26 07:40:58 2026 -0700"
      },
      "message": "x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+\n\nThis gradual step towards removing/inlining subjectsEqual can happen\nafter Go 1.27.0 is released and the bundle starts being generated\nwith it.\n\nChange-Id: Ib315bae69c45922c3f0aac5d2c0155fb5d94229f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/775782\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n"
    },
    {
      "commit": "89f4e9bb5b38861a69b1b26890a6833138d35ace",
      "tree": "8b52c4970646f9ebfdf81234630f453c83e49314",
      "parents": [
        "71488c48c2dfecf900e52caa55f88ef4fef62d54"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Aug 24 16:01:08 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Aug 24 13:54:08 2026 -0700"
      },
      "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: I3be04cd4cb6e44856beaa074fdb62a58ff8ce35b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/820300\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "71488c48c2dfecf900e52caa55f88ef4fef62d54",
      "tree": "348dc59b902d4157562f31067889674b9e0376b9",
      "parents": [
        "82adefa711cb8d9a1f12c7ea91b491007d21819f"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Aug 18 10:23:25 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Aug 23 06:53:19 2026 -0700"
      },
      "message": "ssh/knownhosts: compare only public key portions for revocation\n\nRevocation matching compared full marshaled key blobs, so a @revoked\nline containing a plain host key did not revoke a certificate\ncertifying that key: when the server presented such a certificate,\nIsRevoked only matched the whole certificate blob or the CA key, and\nverification succeeded even though the underlying host key was revoked.\n\nOpenSSH\u0027s check_key_not_revoked compares keys with sshkey_equal_public,\nwhich considers only the public portions and explicitly allows\ncomparisons between certificates and plain keys. Match that behavior by\nnormalizing both @revoked entries and lookups to the underlying public\nkey: for a certificate, the certified key rather than the certificate\nblob. This also makes a @revoked line containing a certificate revoke\nthe plain key it certifies\n\nChange-Id: I3029d59e68fb01f2340763e2eae25cac23c6193d\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/816841\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "82adefa711cb8d9a1f12c7ea91b491007d21819f",
      "tree": "ddf17e8cbca630e4a429fd8e6ae161dcc39fceab",
      "parents": [
        "c757c9851f77c470645455f548046ae0ce87ef8d"
      ],
      "author": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Tue Aug 18 13:38:51 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 19 13:42:46 2026 -0700"
      },
      "message": "ssh: synchronize unexpected response test\n\nWait for an ordered channel request after sending the unsolicited\nresponse flood. This ensures that the client mux has discarded the\nentire flood before SendRequest opens its response gate, avoiding\nconfusion between an in-flight unsolicited response and the expected\nreply.\n\nThis fixes TestChannelUnexpectedResponsesDiscarded from flaking, where\notherwise running 1000000 iterations of the test with GOMAXPROCS\u003d16\nproduced ~15 distinct failures of the form  \"expected success reply\".\n\nChange-Id: Ic1125c1f44bd919a5cf32b889d331bbc94c06c25\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/817140\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "c757c9851f77c470645455f548046ae0ce87ef8d",
      "tree": "985e7aded502ef1cb088f96794d32409be58ab10",
      "parents": [
        "593c81af8aa6582d85a7faaeb996396f63d712a9"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 19 16:59:35 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 19 10:16:24 2026 -0700"
      },
      "message": "all: upgrade go directive to at least 1.26.0 [generated]\n\nBy now Go 1.27.0 has been released, and Go 1.25 is no longer supported\nper the Go Release Policy (see https://go.dev/doc/devel/release#policy).\n\nSee https://go.dev/doc/godebug#go-126 for GODEBUG setting changes\nrelevant to Go 1.26.\n\nFor golang/go#69095.\n\n[git-generate]\n(cd . \u0026\u0026 go get go@1.26.0 \u0026\u0026 go mod tidy)\n(cd x509roots/fallback \u0026\u0026 go get go@1.26.0 \u0026\u0026 go mod tidy)\n\nChange-Id: I54826e019edd4e12ad821915b1d102de719bfb31\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/817981\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n"
    },
    {
      "commit": "593c81af8aa6582d85a7faaeb996396f63d712a9",
      "tree": "e70f76500f24bb8ce3fbde3eafe29d69596f06c2",
      "parents": [
        "46efc8bc62822d876c840e17017ed7071da3087c"
      ],
      "author": {
        "name": "Damien Miller",
        "email": "djm@djm.net.au",
        "time": "Thu Aug 06 18:06:24 2026 +1000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Aug 17 08:34:06 2026 -0700"
      },
      "message": "ssh: correctly ignore pre-banner lines\n\nReading the peer\u0027s benner in readVersion() was incorrectly counting\nlines sent by the server before the actual `SSH-2.0` banner against\nthe line limit for the banner itself.\n\nThis is incorrect per RFC 4253 section 4.2, where the limit of 255\ncharacters is written to apply only to the `SSH-` banner string\nitself.\n\nThis instead limits pre-banner lines to 255 characters each but\ninstead allows a maximum of 1024 lines.\n\nChange-Id: Ief014bb3413e26e8d2077d3eb204ceaea9dc9444\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/811320\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n"
    },
    {
      "commit": "46efc8bc62822d876c840e17017ed7071da3087c",
      "tree": "7db2688d5f605b1d11a91892f9cf1aa2b625b521",
      "parents": [
        "e0a54fdc4bf890e11573ddd8c531dc2cdc6eac47"
      ],
      "author": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Fri Aug 14 09:42:34 2026 -0400"
      },
      "committer": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Mon Aug 17 08:22:44 2026 -0700"
      },
      "message": "acme: add crypto.SignMessage test coverage\n\nThis commit updates the pre-existing TestJWSEncodeJSONCustom test to\nalso verify JWS signature production works with a crypto.MessageSigner.\n\nChange-Id: I5156cb4da9a7feee98340ff4fb75848da5827055\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/815480\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n"
    },
    {
      "commit": "e0a54fdc4bf890e11573ddd8c531dc2cdc6eac47",
      "tree": "c7b9f5b8ca32ce19ff05c4985b253b52a3adfe2d",
      "parents": [
        "f44d03d253a1503e51b059ca880867c51d878242"
      ],
      "author": {
        "name": "Daniel Tang",
        "email": "tangrs@google.com",
        "time": "Fri Aug 14 13:30:58 2026 +1000"
      },
      "committer": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Mon Aug 17 08:21:42 2026 -0700"
      },
      "message": "acme: use crypto.SignMessage instead of calling (crypto.Signer).Sign\n\ncrypto.SignMessage allows using crypto.Signers that only usefully\nimplement SignMessage to be used for the ACME account key.\n\nThis would be useful for opening up integrations with opinionated\nremote signing APIs that don\u0027t support pre-hashing.\n\nFixes golang/go#80877\n\nChange-Id: I86bb76cf5865d3d2b8606a6dbd813cbb26447c86\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/815340\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Sean Liao \u003csean@liao.dev\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n"
    },
    {
      "commit": "f44d03d253a1503e51b059ca880867c51d878242",
      "tree": "d9dc09fa1c9ff439b9f13ea1471f4a31a8374291",
      "parents": [
        "5ed494470b06afb7621b303b04e38366d5863942"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 11 10:19:44 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 11 10:56:31 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I6e7a078f1a8ffe71bace5615ad4fc03a12466985\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/813280\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n"
    },
    {
      "commit": "5ed494470b06afb7621b303b04e38366d5863942",
      "tree": "20112fc725a33a4019013c9750e5abbd11b67393",
      "parents": [
        "b07833c067ec08648541694dc11e02b5ab6b956a"
      ],
      "author": {
        "name": "Julian Zhu",
        "email": "julian.oerv@isrc.iscas.ac.cn",
        "time": "Sat Jan 24 00:11:28 2026 +0800"
      },
      "committer": {
        "name": "Julian Zhu",
        "email": "jz531210@gmail.com",
        "time": "Mon Aug 03 22:01:12 2026 -0700"
      },
      "message": "crypto/internal/poly1305: provide optimised assembly for riscv64\n\ngoos: linux\ngoarch: riscv64\npkg: golang.org/x/crypto/internal/poly1305\n                   │ sum1305-old  │            sum1305-new              │\n                   │    sec/op    │   sec/op     vs base                │\n64-4                  195.9n ± 1%   144.8n ± 0%  -26.07% (p\u003d0.000 n\u003d10)\n1K-4                  1.853µ ± 0%   1.012µ ± 0%  -45.39% (p\u003d0.000 n\u003d10)\n2M-4                  3.627m ± 0%   1.880m ± 0%  -48.17% (p\u003d0.000 n\u003d10)\n64Unaligned-4         196.4n ± 1%   174.7n ± 0%  -11.05% (p\u003d0.000 n\u003d10)\n1KUnaligned-4         1.853µ ± 0%   1.491µ ± 0%  -19.54% (p\u003d0.000 n\u003d10)\n2MUnaligned-4         3.643m ± 0%   2.850m ± 0%  -21.78% (p\u003d0.000 n\u003d10)\nWrite64-4            126.85n ± 0%   77.40n ± 0%  -38.98% (p\u003d0.000 n\u003d10)\nWrite1K-4            1784.5n ± 1%   937.2n ± 0%  -47.48% (p\u003d0.000 n\u003d10)\nWrite2M-4             3.654m ± 2%   1.880m ± 0%  -48.55% (p\u003d0.000 n\u003d10)\nWrite64Unaligned-4    125.7n ± 0%   107.5n ± 0%  -14.48% (p\u003d0.000 n\u003d10)\nWrite1KUnaligned-4    1.782µ ± 0%   1.424µ ± 0%  -20.09% (p\u003d0.000 n\u003d10)\nWrite2MUnaligned-4    3.637m ± 0%   2.850m ± 0%  -21.64% (p\u003d0.000 n\u003d10)\ngeomean               10.14µ        6.925µ       -31.68%\n\n                   │ sum1305-old  │             sum1305-new-3             │\n                   │     B/s      │      B/s       vs base                │\n64-4                 311.7Mi ± 1%    421.5Mi ± 0%  +35.25% (p\u003d0.000 n\u003d10)\n1K-4                 527.0Mi ± 0%    965.0Mi ± 0%  +83.10% (p\u003d0.000 n\u003d10)\n2M-4                 551.4Mi ± 0%   1063.8Mi ± 0%  +92.94% (p\u003d0.000 n\u003d10)\n64Unaligned-4        310.8Mi ± 1%    349.3Mi ± 0%  +12.38% (p\u003d0.000 n\u003d10)\n1KUnaligned-4        526.9Mi ± 0%    654.9Mi ± 0%  +24.30% (p\u003d0.000 n\u003d10)\n2MUnaligned-4        548.9Mi ± 0%    701.8Mi ± 0%  +27.85% (p\u003d0.000 n\u003d10)\nWrite64-4            481.2Mi ± 0%    788.6Mi ± 0%  +63.89% (p\u003d0.000 n\u003d10)\nWrite1K-4            547.2Mi ± 1%   1042.0Mi ± 0%  +90.42% (p\u003d0.000 n\u003d10)\nWrite2M-4            547.4Mi ± 2%   1064.0Mi ± 0%  +94.38% (p\u003d0.000 n\u003d10)\nWrite64Unaligned-4   485.5Mi ± 0%    567.7Mi ± 0%  +16.94% (p\u003d0.000 n\u003d10)\nWrite1KUnaligned-4   547.9Mi ± 0%    685.8Mi ± 0%  +25.17% (p\u003d0.000 n\u003d10)\nWrite2MUnaligned-4   550.0Mi ± 0%    701.9Mi ± 0%  +27.62% (p\u003d0.000 n\u003d10)\ngeomean              485.5Mi         710.7Mi       +46.37%\n\nChange-Id: I33a3df03382eb42ef062b0366521f02559290482\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/738760\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Meng Zhuo \u003cmengzhuo1203@gmail.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\n"
    },
    {
      "commit": "b07833c067ec08648541694dc11e02b5ab6b956a",
      "tree": "6153ea2367fae8e7bcfdb170697227716355660d",
      "parents": [
        "d701c51f7e4e57f61c4947390514fe631e06202f"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 19 20:28:02 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Aug 03 14:00:09 2026 -0700"
      },
      "message": "ssh: return window credit for discarded extended data\n\nhandleData subtracts the length of every data packet from the receive\nwindow, but extended data with a type code other than\nSSH2_EXTENDED_DATA_STDERR is then silently discarded and, since no API\nexists to read it, its window credit was never returned: adjustWindow\nonly runs as a side effect of reading a stream. A peer sending\nextended data with an unknown type code could therefore permanently\nshrink the channel window, down to a complete stall of the channel.\n\nCredit the discarded bytes back through adjustWindow. adjustWindow\nreturns io.EOF if the local side has already sent a channel close;\nignore it like ReadExtended does, since an error returned here would\nterminate the mux read loop and tear down the whole connection. For\ncomparison, OpenSSH rejects extended data with unexpected type codes\noutright and never buffers it, so the dropped bytes are simply never\ncredited back to the misbehaving peer.\n\nFixes golang/go#80333\n\nChange-Id: Ia311ce3ad008e7c89ce9752f1937c91374a4e74f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/802901\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n"
    },
    {
      "commit": "d701c51f7e4e57f61c4947390514fe631e06202f",
      "tree": "ab65509e552011e55050829d0438ac0ebdb2a190",
      "parents": [
        "999d053994c9f2ececb2e85ab0bec72283539e33"
      ],
      "author": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Mon Jul 20 18:10:27 2026 +0000"
      },
      "committer": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Thu Jul 23 08:25:44 2026 -0700"
      },
      "message": "acme: fix nil pointer dereference in pebble test error reporting\n\nThe WaitOrder failure path used errors.Is with a nil *OrderError\ntarget, which never matches and left orderErr nil at the point its\nProblem field was dereferenced. Use errors.As to populate the target\ninstead.\n\nFound by govet\u0027s nilness check.\n\nChange-Id: Ieef849fcbf04c85ef32651059db2b5fe162af325\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803181\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n"
    },
    {
      "commit": "999d053994c9f2ececb2e85ab0bec72283539e33",
      "tree": "6aeba75df1f91a8a5b6bc44376906950bc448ab3",
      "parents": [
        "90f76b8ffe1453c472892d338785687e9727bcc0"
      ],
      "author": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Mon Jul 20 18:10:20 2026 +0000"
      },
      "committer": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Thu Jul 23 08:19:57 2026 -0700"
      },
      "message": "ssh: fix parsing of GSSAPI payloads offering multiple mechanisms\n\nparseGSSAPIPayload overwrote the remaining payload with the trailing\nbytes returned by asn1.Unmarshal after decoding each OID, so any\nrequest offering more than one mechanism failed to parse after the\nfirst one. Track the remaining payload across iterations instead, and\nbe strict: reject payloads with trailing bytes after an OID or after\nthe mechanism list.\n\nAdd a test with a two-mechanism payload (Kerberos V5 followed by\nSPNEGO) that failed before this change.\n\nChange-Id: If0984efcf103da76323d5d03ad7443d8ec9d3aed\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803180\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "90f76b8ffe1453c472892d338785687e9727bcc0",
      "tree": "90c9d5974f4a63e764bf3eccf89dfd98cc08526b",
      "parents": [
        "b53964a1ca4763384f2ee3bf482b8ca67a9f9fa8"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 19 21:07:53 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 22 10:37:06 2026 -0700"
      },
      "message": "ssh: reject certificate signature keys before recursing\n\nparseCert parsed a certificate\u0027s SignatureKey by calling ParsePublicKey\nagain, and only afterwards rejected a certificate used as a signing key.\nFor a chain of nested certificates this recursed once per level, so a key\nwith enough nesting exhausted the goroutine stack and crashed with a fatal\nstack overflow that recover cannot catch.\n\nReject the signature key by its declared algorithm before parsing it, which\nbounds parsing.\n\nFixes golang/go#80414\n\nChange-Id: Id51401aae15bfbec006c03ab97635a3b68bd6058\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/802145\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n"
    },
    {
      "commit": "b53964a1ca4763384f2ee3bf482b8ca67a9f9fa8",
      "tree": "50c5378e307aa890cbb16d78c910f7bfe2c168c8",
      "parents": [
        "626e40fc986f72b464ecb2063e02e7923bf3025d"
      ],
      "author": {
        "name": "database64128",
        "email": "free122448@hotmail.com",
        "time": "Mon Jul 13 20:04:08 2026 +0800"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 22 10:37:01 2026 -0700"
      },
      "message": "ssh: permit empty but non-nil HostKeyAlgorithms, KeyExchanges, Ciphers, MACs\n\nThe documentation of ClientConfig.HostKeyAlgorithms says:\n\n  If empty, a reasonable default is used.\n\nHowever, if HostKeyAlgorithms is empty but non-nil, the reasonable\ndefault won\u0027t be applied, and the SSH handshake will fail. Fix this by\nchanging the nil check to a length check.\n\nWhile here, do the same for KeyExchanges, Ciphers, MACs in Config.\n\nChange-Id: I1b3d2d2159f3c7d57a9a690ad04f1f6818b39a5c\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/800080\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n"
    },
    {
      "commit": "626e40fc986f72b464ecb2063e02e7923bf3025d",
      "tree": "aec4de2e130558ee3a43335ee2911cd5c56894cc",
      "parents": [
        "31914c699bfcc4906a7f6a178e910388518ed6a3"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 19 20:08:16 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Wed Jul 22 10:34:36 2026 -0700"
      },
      "message": "ssh: drain stderr on forwarded TCP and Unix channels\n\ntcpListener.Accept, unixListener.Accept, Client.dial and\nClient.dialStreamLocal only read the main stream of the channels they\nreturn. Data sent by the peer on the extended (stderr) stream\naccumulates in the extPending buffer and its window credit is only\nreturned by ReadExtended, which is never called. Since the window is\nshared between the two streams, a misbehaving peer can pin up to 2 MiB\nper channel and eventually stall it; well-behaved peers never send\nstderr on these channel types.\n\nDrain the stderr stream into io.Discard, mirroring CL 783720 which\nfixed the same issue in the agent forwarders.\n\nThe drain takes precedence over reading Stderr through a type assertion\non the returned net.Conn, which was never a supported use. For\ncomparison, OpenSSH refuses extended data on these channel types and\ndrops the payload without buffering it.\n\nUpdates golang/go#80333\n\nChange-Id: I4f1445eee9ce1b56ca62cec342812d63cfdd3e13\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/802900\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "31914c699bfcc4906a7f6a178e910388518ed6a3",
      "tree": "a421a7598f42da69392d47395d9d83fe695761e1",
      "parents": [
        "f2135b814ca127b11d04d6d6f0e6569922bace0f"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jul 20 16:01:05 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jul 21 14:38:23 2026 -0700"
      },
      "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: Ic89f2ab75500d9b03a76236f2228657508a4d16d\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803060\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "f2135b814ca127b11d04d6d6f0e6569922bace0f",
      "tree": "cd52174eeb31eea72752e41ed15a6de6995e2e04",
      "parents": [
        "ff03dafdb03eafe35dd29a219550a907489a7a69"
      ],
      "author": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Mon Jul 20 18:10:38 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jul 21 14:30:59 2026 -0700"
      },
      "message": "all: clean up minor issues found by staticcheck\n\nUse bytes.Equal instead of comparing bytes.Compare results to zero,\navoid Yoda conditions, drop a redundant zero slice capacity, use\nstrings.ReplaceAll, build acme error strings with a strings.Builder,\nand lowercase an error string in ocsp. No behavior changes.\n\nChange-Id: I5d2b3fa5c241adc75e61be0f2d2d7af1eb9e8d66\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/803200\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n"
    },
    {
      "commit": "ff03dafdb03eafe35dd29a219550a907489a7a69",
      "tree": "8a8112d4608e920dcec99ced4e7c979ecf557761",
      "parents": [
        "10b54ffa51b134f7100e147742e5fc7d8d818a11"
      ],
      "author": {
        "name": "Akira",
        "email": "50253469+Daquisu@users.noreply.github.com",
        "time": "Wed Jul 15 00:46:40 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jul 17 15:41:46 2026 -0700"
      },
      "message": "ssh: report verified signature format to callback\n\nVerifiedPublicKeyCallback currently receives the public-key algorithm\ndeclared in the outer authentication request. For RSA authentication,\nthat value can differ from the format of the signature that was\nsuccessfully verified because compatible RSA algorithm combinations are\naccepted.\n\nThis can cause post-verification policy or audit decisions to use the\nrequest algorithm instead of the signature format actually verified.\n\nPass sig.Format to VerifiedPublicKeyCallback so signatureAlgorithm\nidentifies the successfully verified signature format. Clarify the\ncallback documentation and add a regression test covering compatible\nbut different RSA request algorithms and signature formats.\n\nFixes golang/go#80411\n\nChange-Id: Ib405378d75367a90536e0814c9d26d4dec9aaa25\nGitHub-Last-Rev: 1a4acd4e639361be1f2948a4aef1013436a75ecf\nGitHub-Pull-Request: golang/crypto#364\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/800740\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nAuto-Submit: Michael Pratt \u003cmpratt@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "10b54ffa51b134f7100e147742e5fc7d8d818a11",
      "tree": "772649a97d7d87d288822056b16fda601db8da42",
      "parents": [
        "0f039f3a4ad8093b3587dd32a675f6f101f902ed"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Jun 29 19:13:41 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Jul 13 20:33:21 2026 -0700"
      },
      "message": "ssh: raise the RSA modulus limit to 16384 bits\n\nthe fix for CVE-2026-39829 capped the accepted RSA modulus at 8192 bits,\nmatching crypto/tls, to bound the CPU cost of verifying an\nattacker-supplied key. That rejected keys OpenSSH generates: ssh-keygen\nallows -b up to 16384. Raise the limit to 16384 so those keys interoperate,\nboth in the public key parser and the OpenSSH private key parser, and\ncorrespondingly raise the prime-factor bound to 8192 bits (each prime is\nabout half the modulus). The agent\u0027s checkRSAKeyParams is updated to match.\n\nVerifying a 16384-bit key costs roughly 3x an 8192-bit one.\n\nFixes golang/go#80075\n\nChange-Id: Ib08ddd7b48552e692c48dbdf105bbc8579120bbc\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/795421\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "0f039f3a4ad8093b3587dd32a675f6f101f902ed",
      "tree": "7bbbc79ceef05bd1099ab79fa7c02774d356e311",
      "parents": [
        "b27e1504e38fe3d716ce5e0043304791f99fb295"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed Jul 08 12:15:26 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jul 13 12:23:17 2026 -0700"
      },
      "message": "ssh: sanitize various error messages\n\nSimilar to CL 780180, sanitize other error messages that are controlled\nby the remote peer, to avoid potential injection of control characters.\n\nAlso remove sanitizeString usage as it is not strictly needed to escape\nerror messages safely, and for consistency with how we sanitize other\nerror messages throughout the codebase.\n\nBannerDisplayStderr is left unsanitized for now, as it is one instance\nwhere we might actually want control characters for valid reasons (see\ngolang/go#80302).\n\nUpdates golang/go#80302\nFixes golang/go#80301\n\nChange-Id: Ie40f4ac2f76afed740dceb548a4b0fa96a6a6964\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/798420\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b27e1504e38fe3d716ce5e0043304791f99fb295",
      "tree": "da82f3ac3d063da2229ffa7877a06618f4882e3f",
      "parents": [
        "c1a3b97d708a15b7b939b739ba276187844849a2"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Jun 29 18:53:37 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jul 13 12:20:29 2026 -0700"
      },
      "message": "ssh: don\u0027t close the connection on an unparseable public key\n\nIn the server\u0027s publickey authentication path, a public key blob that\nParsePublicKey could not decode caused serverAuthenticate to return an\nerror, tearing down the whole connection. A key we cannot parse is part\nof an individual authentication attempt, not a transport-level framing\nerror, so it must fail only that attempt. This lets the client fall\nback to other keys or authentication methods.\n\nUpdates golang/go#80075\n\nChange-Id: I8d882d08bb50eb33e0054d9d9c2bd9e0b3039443\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/795420\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n"
    },
    {
      "commit": "c1a3b97d708a15b7b939b739ba276187844849a2",
      "tree": "af0f0f075c505bd9555644a5f46a393435bb49e4",
      "parents": [
        "b9229ecc70c7deaaeb07ce6c13427349d6d4ffcc"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 05 19:37:35 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 12 08:19:47 2026 -0700"
      },
      "message": "ssh: document and test source-address behavior for non-IP transports\n\nThe source-address critical option is a comma-separated list of IP\naddresses and CIDR blocks, so it can never match a connection whose\nremote address is not IP-based, such as a Unix domain socket.\n\nChange-Id: I45e09fe5c8c13922cb0735278acf33320857322c\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797042\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "b9229ecc70c7deaaeb07ce6c13427349d6d4ffcc",
      "tree": "23a7567e128a4a34cf881975698f815ce927d4b3",
      "parents": [
        "e557b08ec2b4f5dd00f38356919fc7b051dd88f8"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 05 19:00:35 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 12 08:19:43 2026 -0700"
      },
      "message": "ssh: reject a present but empty source-address critical option\n\ncheckSourceAddressCriticalOption treated a source-address critical\noption with an empty value as if the option was absent, allowing\nauthentication from any address. A callback (or certificate authority)\nbuilding the value dynamically from an empty allowlist would intend to\ndeny all sources, not to lift the restriction. This also contradicts\nthe documented contract that the option is validated whenever it is\npresent, and differs from OpenSSH, where an empty address list matches\nnothing.\n\nChange-Id: I1c0de27cbcab8817a7ff446019c25cd19957a7d7\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797041\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n"
    },
    {
      "commit": "e557b08ec2b4f5dd00f38356919fc7b051dd88f8",
      "tree": "9f9139f33e45b9ece10c070085807f5d3e56051e",
      "parents": [
        "4044611da8b85cbd5eb55c657d59244ffb18d3e4"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 05 18:50:56 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 12 08:19:37 2026 -0700"
      },
      "message": "ssh: enforce the source-address critical option for all auth callbacks\n\nCVE-2026-46595 extended source-address validation, historically applied\nonly to the Permissions returned by PublicKeyCallback, to the ones\nreturned by VerifiedPublicKeyCallback. The documented contract of\nPermissions.CriticalOptions does not restrict enforcement to a specific\nauthentication method, so move the check to a single point at the end of\neach authentication attempt, where it covers the Permissions returned by\nany callback (password, keyboard-interactive, none and GSSAPI included).\n\nThe check at public key cache insertion time is kept: it remains\nauthoritative for the Permissions returned by PublicKeyCallback, which\nVerifiedPublicKeyCallback may replace before the check at the end of the\nauthentication attempt runs and which are not re-checked on partial\nsuccess. It also still makes public key queries fail before the client\nproduces a signature when PublicKeyCallback supplies the restriction.\n\nFixes CVE-2026-56854\nFixes golang/go#80213\n\nChange-Id: Ibd612a8e4240bd710e33754f3ceb95bb29169d9a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797040\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "4044611da8b85cbd5eb55c657d59244ffb18d3e4",
      "tree": "148ec717f2aa2a695c6eb5caa34ee5c0a7b9a511",
      "parents": [
        "e8ad5cb7aacc413e7071604faf8feb5e51eac000"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 05 20:14:11 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 12 08:19:29 2026 -0700"
      },
      "message": "ssh: fix data race in the doClientServerAuth test helper\n\nThe helper returned the auth errors collected via AuthLogCallback\nwithout waiting for the server goroutine that appends to them. Close\nthe client side of the connection on handshake failure, to unblock a\nserver still reading from it, and join the server goroutine before\nreturning.\n\nChange-Id: Ibe8c3b236491769f3433f7457d4f2b9a07a65be0\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797043\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "e8ad5cb7aacc413e7071604faf8feb5e51eac000",
      "tree": "b16c7cc246efb725e95dc5b3af8b4f3086462945",
      "parents": [
        "fe1af3a4189650f6a61d30bfcb431e61bb141f41"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 05 20:41:50 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 12 08:19:12 2026 -0700"
      },
      "message": "ssh: initialize new channels fully before adding them to chanList\n\nnewChannel published the channel into the mux\u0027s chanList (via\nchanList.add) before assigning its localId, and openChannel/Accept set\nmaxIncomingPayload only after newChannel returned. For an outbound\nchannel, whose newChannel runs on an application goroutine, the mux\nloop could observe the channel through getChan before those fields\nwere initialized, reading a zero localId or maxIncomingPayload with no\nhappens-before relationship.\n\nAssign localId inside add while the chanList lock is held, and set\nmaxIncomingPayload (always channelMaxPacket) in newChannel itself, so\na channel returned by getChan is always fully initialized.\n\nChange-Id: Ib54a5d10dcb5c1ad8ed4dabe5d8d2790778be298\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797061\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "fe1af3a4189650f6a61d30bfcb431e61bb141f41",
      "tree": "395cff39cb044b4c7dfbe0da1889ebc5835d6b9d",
      "parents": [
        "243e02a382f85bf94966b9c5c999f9ebae97df2e"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 05 20:20:39 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Jul 12 08:19:06 2026 -0700"
      },
      "message": "ssh: make channel.close idempotent\n\nchannel.close closes the internal Go channels (msg, incomingRequests);\ncalling it twice panics with \"close of closed channel\". Both current\ncallers run on the mux loop and are serialized, so the panic is not\nreachable today. Harden close by guarding it with sync.Once, so that\nthe connection does not become fragile to any future bug that reaches\nclose twice.\n\nChange-Id: I5d8d948367538ea5561724033c4ee4daa668e221\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/797060\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "243e02a382f85bf94966b9c5c999f9ebae97df2e",
      "tree": "33f37a90e19bec0a1c27056a94ea2875f03ea292",
      "parents": [
        "cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62"
      ],
      "author": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Wed Jul 08 10:12:08 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Jul 09 11:40:58 2026 -0700"
      },
      "message": "ocsp: update ParseRequest docs \u0026 error conditions\n\nParseRequest was documented as erroring for inputs that contained\nan optional request signature, and as only supporting requests for\na single certificate.\n\nHowever, prior to this commit DER inputs that contained a signature\nsucceeded without verifying the signature, and inputs that contained\nmultiple certificate identifiers succeeded but only the first\ncertificate identifier was unmarshalled.\n\nThis commit updates the function behaviour to return an error for the\nsignature case as described in the docs, and to clarify the\ndocumentation for inputs with multiple certificate identifiers.\n\nFixes golang/go#80300\n\nChange-Id: I7446422d6c98bd406b8c43e55fea9a16ace9d4a6\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/798220\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "cdce021fa6c7d9c7eb2743bfbe551f0a98fd5d62",
      "tree": "ef07d8c046727edc3a016ed95145cf47320e5417",
      "parents": [
        "d9474cc4853d9ef1a29356975408d4771e5770c6"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 09:21:34 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 11:22:26 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I431b878ec8830bf1894ae19176b5984b00954557\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/798280\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n"
    },
    {
      "commit": "d9474cc4853d9ef1a29356975408d4771e5770c6",
      "tree": "ce72d849ffb2733aa530cacb0076e32dde50873b",
      "parents": [
        "7626c5025624025bb44739a805f431cf93c06d6e"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Wed Jun 24 17:41:52 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jul 07 10:06:58 2026 -0700"
      },
      "message": "openpgp: make the deprecation message more explicit\n\nThe package is unmaintained, unsafe at any speed, and does not receive\nsecurity fixes. Document that, and point at the ProtonMail fork for\nthose that _must_ still use OpenPGP.\n\nChange-Id: Ia602eaaf9e08bd25389400ebe7f346b60bdb9d99\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/794200\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "7626c5025624025bb44739a805f431cf93c06d6e",
      "tree": "e1efe0842f3ca782263b6d97b23f6b59b1fcf7fd",
      "parents": [
        "0471e7969e6740594dfe354646bf03e5e89de52d"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu Jun 04 15:59:34 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 30 10:24:32 2026 -0700"
      },
      "message": "ssh: verify declared key type matches decoded key in authorized_keys\n\nParseAuthorizedKey and ParseKnownHosts previously ignored the key type\nfield (e.g. \"ssh-rsa\") in each entry, relying solely on the type\ninformation embedded within the base64-encoded key blob.\n\nFor ParseAuthorizedKey this also caused a single-token option to be\nsilently dropped: a line such as \"restrict \u003ckey\u003e\" (with the key type\nomitted) was parsed as an unrestricted key, because the option token\nlanded in the key type position and was discarded together with its\nmeaning. The same happens for no-pty, no-port-forwarding and the other\nsingle-word options. OpenSSH\u0027s sshkey_read rejects such lines outright,\nas the option token cannot be read as a key type.\n\nOpenSSH\u0027s sshkey_read also explicitly verifies that the key type\ndeclared in the text matches the type of the parsed key, returning\nSSH_ERR_KEY_TYPE_MISMATCH if they differ.\n\nThis change adds, in both functions, a check that the declared key type\nmatches the decoded key\u0027s type, returning an error for malformed lines\nwhere they diverge. This mirrors the fix already applied to the\nssh/knownhosts package in CL 782427.\n\nChange-Id: I9163108d964de4be8a415fe0efd68e6b71f77990\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/792840\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "0471e7969e6740594dfe354646bf03e5e89de52d",
      "tree": "512c889fed163313aabd039c3f5fa1c60b2f0664",
      "parents": [
        "6435c37ab681759aff37ba751d0f2238b3043767"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Jun 29 19:45:55 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 30 10:06:28 2026 -0700"
      },
      "message": "ssh/agent: enforce strict limits on DSA key parameters\n\nThe parseDSAKey function constructed a *dsa.PrivateKey directly from the\nadd-identity request without validating the key parameters. Unlike DSA\ncertificates, whose parameters are checked by the ssh package when the\ncertificate\u0027s public key is parsed, raw DSA keys added to the agent were\nnot validated at all.\n\nAlign the raw DSA key parsing with the validation already performed by\nthe main ssh package.\n\nFixes golang/go#79725\n\nChange-Id: I537cc2175d35c19848c90c68739cf94ba7b50e10\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/795422\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "6435c37ab681759aff37ba751d0f2238b3043767",
      "tree": "29c47a013ad4707ed5c46fd08e70c688cd1a9941",
      "parents": [
        "7d695da948bfa44ed6eedcebc8f43bcb50e94a57"
      ],
      "author": {
        "name": "Neal Patel",
        "email": "neal@golang.org",
        "time": "Tue May 19 20:30:03 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 29 10:23:17 2026 -0700"
      },
      "message": "ssh: sanitize client disconnect messages\n\nA malicious peer can send control characters\nand escape sequences in SSH_MSG_DISCONNECT;\nstrip these characters and %q escape it.\n\nChange-Id: I266f78630a7a816a79ce4dda568ce57d7c3f6fb0\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/780180\nCommit-Queue: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\n"
    },
    {
      "commit": "7d695da948bfa44ed6eedcebc8f43bcb50e94a57",
      "tree": "e0b17c9253dd8db2e8ebe1a6ecc09f2529075a36",
      "parents": [
        "5b7f84159940519e89df4d95465538c1797cee8b"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Wed May 27 11:59:43 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Mon Jun 29 06:36:26 2026 -0700"
      },
      "message": "ssh/agent: drain channel stderr in agent forwarders\n\nForwardToAgent and ForwardToRemote only read the main stream of the\nauth-agent@openssh.com channels they accept. If a peer sends data on\nthe channel\u0027s extended (stderr) stream the bytes accumulate in the\nclient-side extPending buffer and the receive window is never\nreplenished, because the window is only adjusted as a side effect of\nReadExtended. That can pin up to channelWindowSize (2 MiB) of memory\nper channel and silently stalls any stderr traffic once the window is\nexhausted.\n\nThe auth-agent protocol does not use stderr, so a well-behaved peer\nnever sends anything on it. To stay tolerant of misbehaving peers\nwithout leaving the channel half-stuck, drain the stderr stream into\nio.Discard, mirroring the existing DiscardRequests pattern. The\ngoroutine exits when the channel is closed because Stderr().Read\nreturns io.EOF.\n\nAdd a regression test that opens an agent-forwarding channel and\nwrites more than the default window on the stderr stream from the\nserver side. Without the fix the write blocks once the remote window\nis exhausted; with the fix the bytes are drained and the agent stream\nremains usable.\n\nChange-Id: Iadf8ea6ca726c058421bbc39f92e0100579fda17\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/783720\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "5b7f84159940519e89df4d95465538c1797cee8b",
      "tree": "c7afebae1e8fd43cc05679550b7af9d8da1bef47",
      "parents": [
        "0b316e7ee409f8e5789a0535679d34155cecc75e"
      ],
      "author": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Wed Jun 24 11:30:04 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jun 26 08:59:20 2026 -0700"
      },
      "message": "acme/autocert: fix data race in Manager.createCert\n\nPreviously Manager.createCert() read state.locked without holding any\nlock, while the owner goroutine wrote state.locked \u003d false under the\nstate\u0027s write lock. Concurrent goroutines for the same domain raced on\nthat field.\n\nWe fix the issue by removing the certState.locked field and instead\nhaving Manager.certState() return an additional owner bool computed\nunder the m.stateMu lock. This allows the Manager.createCert() caller to\nknow whether it must block on the read lock and return the state handled\nby another goroutine, or instead do the work itself and release the\nwrite lock.\n\nA regression unit test is included that fails under -race without the\nfix, and passes with the fix in-place.\n\nFixes golang/go#80119\n\nChange-Id: I0f4c5c98f7e6bcf1ab71a3c0707bb0c7ce73415b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/793840\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\n"
    },
    {
      "commit": "0b316e7ee409f8e5789a0535679d34155cecc75e",
      "tree": "9c137719c35f9a96036a6e55e9bb37f579b82d05",
      "parents": [
        "55aec0a86b4c522b4f7366e69db55349e9f7ff5c"
      ],
      "author": {
        "name": "harjoth",
        "email": "harjoth.khara@gmail.com",
        "time": "Wed Jun 10 15:48:43 2026 +0000"
      },
      "committer": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Thu Jun 18 09:22:19 2026 -0700"
      },
      "message": "argon2: update RFC 9106 parameter recommendations\n\nUpdate the IDKey example to use RFC 9106\u0027s first recommended Argon2id\noption and clarify the relationship between the first and second\nrecommended options.\n\nFixes golang/go#79823\n\nChange-Id: If44a86a5a8112b02fab97b4d5e325fe91d6049ee\nGitHub-Last-Rev: a764ae65875f12d7422865c4e83f345a8a4f246e\nGitHub-Pull-Request: golang/crypto#357\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/789020\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "55aec0a86b4c522b4f7366e69db55349e9f7ff5c",
      "tree": "4264c6392a1d6f85f4e8aaa85583dfb582c11478",
      "parents": [
        "5f2de1a9f1e29059fbb9f3d34321bd0da935556b"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 15 21:14:50 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 15 14:38:55 2026 -0700"
      },
      "message": "x509roots/fallback: update bundle\n\nThis is an automated CL which updates the NSS root bundle.\n\n[git-generate]\ngo generate ./x509roots\n\nChange-Id: I448f9962a67bf042b04a2e34f16ae02a004d6edd\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/791040\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "5f2de1a9f1e29059fbb9f3d34321bd0da935556b",
      "tree": "3de906699928fb58fb4d3fa68b9e29760478b01d",
      "parents": [
        "45460e079737ecb64f30d79d3d6fc2914494fa66"
      ],
      "author": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Mon Mar 23 16:24:22 2026 -0400"
      },
      "committer": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Tue Jun 09 11:23:32 2026 -0700"
      },
      "message": "internal: remove wycheproof tests\n\nEquivalent coverage using newer Wycheproof vectors has been added to the\nstandard library, alongside the implementations under test.\n\nIn the case where the algorithm doesn\u0027t exist in the stdlib, but is\nintended to be supported there one day (e.g. chacha20poly1305) we flip\nthe relationship and run the Wycheproof tests from the stdlib on the\nvendored /x/crypto. As a result the legacy Wycheproof coverage in this\nrepo can be removed.\n\nChange-Id: Ic07d559e42599b715906f5bcc39be10944a8dde4\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/758420\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nAuto-Submit: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "45460e079737ecb64f30d79d3d6fc2914494fa66",
      "tree": "bef53260d466e2d7ce5f9a0cb0375e9a133ce04b",
      "parents": [
        "d37c95e27de65576f42440cdfbc261d810506841"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 08 08:43:49 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 08 08:52:49 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I1dc78ceffd32c80457b284aa1bcefb6dfc2757ba\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/788222\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n"
    },
    {
      "commit": "d37c95e27de65576f42440cdfbc261d810506841",
      "tree": "ee7dd55b2956701227782d88bae503f9f247294b",
      "parents": [
        "e2ffffe738fb46531cd8924bab497bdc77d9ecc8"
      ],
      "author": {
        "name": "mohammadmseet-hue",
        "email": "mohammadmseet@gmail.com",
        "time": "Mon Apr 06 20:10:40 2026 +0000"
      },
      "committer": {
        "name": "Daniel McCarney",
        "email": "daniel@binaryparadox.net",
        "time": "Thu Jun 04 06:58:05 2026 -0700"
      },
      "message": "pkcs12: limit PBKDF iteration count to prevent CPU exhaustion\n\nThe PKCS#12 PBKDF iteration count is read directly from\nthe input file with no upper bound. A crafted 83-byte .p12\nfile can set iterations to 2^31-1 (2147483647), causing\nDecode() to block a CPU core permanently.\n\nThis change adds a maximum iteration limit of 1000000 in\nboth verifyMac and pbDecrypterFor. Any file that specifies\nmore iterations than this cap is rejected with an error.\n\nFor reference, OpenSSL caps PBKDF2 at 10000000 iterations,\nand scrypt is bounded by its memory-hardness parameters.\nThe 1000000 limit is generous for legitimate PKCS#12 files\nwhile still preventing denial of service.\n\nFixes golang/go#78524\n\nChange-Id: I1d12d6f5d90e347ca0dc113678abc51b0cff8d85\nGitHub-Last-Rev: a0370d492dd4735cc7c1bb082b359ad79863fdae\nGitHub-Pull-Request: golang/crypto#343\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/759900\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "e2ffffe738fb46531cd8924bab497bdc77d9ecc8",
      "tree": "b1c31ba161d1d87446d4d1fe3235d0b7acfe37a2",
      "parents": [
        "60e158ad30c226555794539d96f0f104f43395f7"
      ],
      "author": {
        "name": "povcfe",
        "email": "povcfe2sec@gmail.com",
        "time": "Mon May 04 03:14:35 2026 +0000"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:25:39 2026 -0700"
      },
      "message": "ssh: reject incomplete gssapi-with-mic configurations\n\nMake the runtime gssapi-with-mic guard match the existing\nconfiguration and method advertisement checks.\n\nAn incomplete GSSAPIWithMICConfig can be treated as unavailable when\nbuilding the advertised auth method list, while still remaining\nreachable from the runtime auth dispatcher. Treat incomplete\nconfigurations as not configured.\n\nThis change introduces a single internal completeness check for\nGSSAPIWithMICConfig and uses it for the startup authentication\nvalidation, the runtime gssapi-with-mic dispatch guard, and the\nadvertised authentication method list.\n\nThe change also adds a regression test. The test configures a server\nwith a normal PasswordCallback, a GSSAPIWithMICConfig with Server set,\nand AllowLogin intentionally unset. It then uses a custom client auth\nmethod that explicitly sends a USERAUTH_REQUEST with Method set to\ngssapi-with-mic even though the server does not advertise that method,\nand verifies that authentication fails cleanly with\n\"ssh: gssapi-with-mic auth not configured\".\n\nNo golang/go issue reference is available yet.\n\nChange-Id: I9a0c965d3a56192bd68309aa41e2c1f91952036c\nGitHub-Last-Rev: 0267bda8e15e7c258ba3b92cd54f0941534c5fc9\nGitHub-Pull-Request: golang/crypto#345\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/773460\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "60e158ad30c226555794539d96f0f104f43395f7",
      "tree": "dea9dc7b5181d09d932f9201fac609be638383e7",
      "parents": [
        "1b77d23dc8afb26a494e331a3c637b6de88398d2"
      ],
      "author": {
        "name": "Mike Nolta",
        "email": "mike@nolta.net",
        "time": "Thu May 14 09:51:25 2026 -0400"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:25:33 2026 -0700"
      },
      "message": "ssh/test: isolate CLI tests from user SSH config and agent\n\nPass -F none and -o IdentityAgent\u003dnone to ssh(1) invocations in the\nCLI tests. Without these flags, a user\u0027s ~/.ssh/config can enable\nControl{Master,Persist}, which causes the ssh process to fork a\nbackground daemon that holds stdout/stderr pipes open, preventing\nCombinedOutput from ever returning. The agent flag prevents keys loaded\nin the user\u0027s SSH agent from being offered to the server before the test\nkey, which would exhaust MaxAuthTries and cause a disconnect.\n\nFixes golang/go#79411\n\nChange-Id: Id5b073e6df661006183d000928d7ef6e6096b933\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/777900\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Daniel McCarney \u003cdaniel@binaryparadox.net\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "1b77d23dc8afb26a494e331a3c637b6de88398d2",
      "tree": "5b4d77811464d2c1f7b2fbb77f21080a4b826df0",
      "parents": [
        "3872a2bc69f464352dea49c2856955ef7c5d5851"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 17:56:18 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:24:36 2026 -0700"
      },
      "message": "ssh/knownhosts: reject lines with multiple or unknown markers\n\nPreviously, parseLine would accept lines with multiple markers (e.g.,\n\"@cert-authority @revoked ...\") or unknown markers (e.g., \"@unknown ...\").\nIn these cases, the second or unknown marker was incorrectly parsed as\nthe hostname. This often resulted in confusing downstream errors (like\n\"illegal base64 data\") because field positions were shifted.\n\nOpenSSH\u0027s hostfile.c strictly enforces a limit of one marker per line\nand validates that markers must be exactly \"@cert-authority\" or\n\"@revoked\".\n\nThis change adds a check to ensure that the parsed hostname does not\nstart with \u0027@\u0027. This effectively catches both multiple markers (where\nthe second marker becomes the host) and unknown markers (which are not\nconsumed as markers and thus become the host), enforcing strict\ncompliance with the OpenSSH format.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: I13bb04d1f2610483ad9c6d1020e5100b6feded90\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782428\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n"
    },
    {
      "commit": "3872a2bc69f464352dea49c2856955ef7c5d5851",
      "tree": "d86b0a14871ed7977cad5203f03a0f28dd69d541",
      "parents": [
        "9f72eccdf6fa09a7c68448a7fdc333dd2deb7d9d"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 17:51:30 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:24:24 2026 -0700"
      },
      "message": "ssh/knownhosts: verify declared key type matches decoded key\n\nThe parseLine function previously ignored the key type field (e.g.,\n\"ssh-rsa\") in known_hosts entries, relying solely on the type\ninformation embedded within the base64-encoded key blob.\n\nOpenSSH\u0027s sshkey_read implementation explicitly verifies that the key\ntype declared in the text matches the type of the parsed key, returning\nSSH_ERR_KEY_TYPE_MISMATCH if they differ.\n\nThis change adds a check to ensure the declared key type matches\nkey.Type(), returning an error for malformed lines where they diverge.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Id4f35c74055f5691088273630b50cdd02c81bfe9\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782427\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "9f72eccdf6fa09a7c68448a7fdc333dd2deb7d9d",
      "tree": "6da6fb9953f01f178fb46816cf8a1a71364628bd",
      "parents": [
        "8f405a4109d7ce87a44f89185bdc385914ce5c13"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 17:47:48 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:24:19 2026 -0700"
      },
      "message": "ssh/knownhosts: treat only ASCII space and tab as whitespace\n\nThe previous implementation used bytes.TrimSpace, which strips all\nUnicode whitespace categories (e.g., non-breaking spaces). However,\nOpenSSH\u0027s known_hosts parser (hostfile.c) strictly treats only ASCII\nspace (0x20) and horizontal tab (0x09) as separators.\n\nThis discrepancy meant the Go parser might interpret fields differently\nthan OpenSSH, potentially treating parts of a key or hostname as\nseparators if they contained Unicode whitespace.\n\nThis change replaces bytes.TrimSpace with a local trimSpace helper that\nonly trims \" \\t\", ensuring parsing behavior consistent with the\nreference implementation.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Ia536889636de2c167d2507c01e3f1b7c033c9a8f\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782426\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "8f405a4109d7ce87a44f89185bdc385914ce5c13",
      "tree": "60b7980c61f51be1a1cd48d59ccebbc36c2b4708",
      "parents": [
        "bb41b3dbe630c21c78e3aeb0ebdd8d06a3a34fcf"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 17:35:21 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:24:14 2026 -0700"
      },
      "message": "ssh: validate ECDSA curve matches expected algorithm\n\nPreviously, parseECDSA determined the curve purely based on the key\nblob content, ignoring the algorithm identifier passed to parsePubKey.\n\nThis allowed a mismatch where a key could be encoded with an algorithm\ntype of \"ecdsa-sha2-nistp256\" but contain a NIST P-384 or P-521 curve.\nThe parser would succeed, returning a key with a type different from\nthe one indicated by the caller/wire format.\n\nThis change updates parseECDSA to accept the expected algorithm type\nand verify that it matches the curve specified in the key data. This\nmatches the behavior of OpenSSH\u0027s ssh_ecdsa_deserialize_public in\nssh-ecdsa.c, which rejects a curve identifier that does not correspond\nto the key algorithm name.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: I9c748be948cca65e2f41089bb7510466d3bb316a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782425\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n"
    },
    {
      "commit": "bb41b3dbe630c21c78e3aeb0ebdd8d06a3a34fcf",
      "tree": "f885c12fa8a07774a64f125f51a7e0891fb6273d",
      "parents": [
        "e04e7219970912a40f80c4b13029416fdf960eeb"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 17:26:02 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 00:23:03 2026 -0700"
      },
      "message": "ssh: improve DH GEX group selection using PreferredBits\n\nPreviously, the server selected the Diffie-Hellman group based solely on\nthe MaxBits value provided by the client. This resulted in suboptimal\nmodulus selection, often ignoring the client\u0027s PreferredBits or selecting\na larger-than-necessary group.\n\nThis change implements a \"best fit\" selection algorithm similar to\nOpenSSH\u0027s choose_dh logic. It attempts to find the smallest available\ngroup larger than or equal to the client\u0027s PreferredBits, falling back to\nthe largest available group within the accepted range if no group above\nthe preference is available.\n\nAdditionally, this commit caches the parsed Oakley groups using\nsync.OnceValue, avoiding repeated big.Int parsing on every handshake\nwhile keeping the cost out of package initialization.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Idfa81bbcf354a7fb7b541cb4bbeb6e4a0181398a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782424\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "e04e7219970912a40f80c4b13029416fdf960eeb",
      "tree": "9f52f6a78988019ac4fee80c62b34fc01224ea32",
      "parents": [
        "b315afd69a138d4d9d8bd44a9524bf78a37cf479"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 17:05:34 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:22:54 2026 -0700"
      },
      "message": "ssh/agent: validate ed25519 private key length in Add\n\ninsertKey and insertCert assume an ed25519.PrivateKey is exactly\n64 bytes long: a 32-byte seed followed by a 32-byte public key.\nThe expression []byte(k)[32:] panics with \"slice bounds out of\nrange\" when a shorter slice is passed, which is reachable through\nthe exported Add API and crashes the caller process.\n\nReject ed25519 keys whose length is not ed25519.PrivateKeySize in\nall four branches (value and pointer variants of insertKey and\ninsertCert), using the same error wording already used by\nparseEd25519Cert in server.go.\n\nThis issue was found during a security audit by NCC Group\nCryptography Services, sponsored by Teleport, and was assessed\nand is being fixed as a non-security bug.\n\nChange-Id: I4a053835588aad4c3482fe1ca8045542cd960500\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782423\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "b315afd69a138d4d9d8bd44a9524bf78a37cf479",
      "tree": "603602b4467985eb9775564007043fa13d510be5",
      "parents": [
        "d4a85f4749786ae186cafe0ac4af0c21a59cfb9d"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 16:48:48 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:22:48 2026 -0700"
      },
      "message": "ssh: limit bcrypt KDF rounds in OpenSSH private key decryption\n\npassphraseProtectedOpenSSHKey decodes the bcrypt round count from\nthe key file and passes it directly to bcrypt_pbkdf.Key, whose\nrunning time is linear in that count. Files specifying very large\nround values cause the decryption to consume excessive CPU time:\na uint32 maximum is several months of work on commodity hardware.\n\nCap the accepted round count at 2048 (128x the default of 16, a\nfew seconds of CPU on a modern core). OpenSSH itself does not\nimpose an upper bound, but accepting arbitrary values turns key\nloading into a resource-exhaustion footgun for any code that\nprocesses files supplied by end users.\n\nThis issue was found during a security audit by NCC Group\nCryptography Services, sponsored by Teleport, and was assessed\nand is being fixed as a non-security bug.\n\nChange-Id: I01112bdf1b484ae4fab5dc8841d1a272f112df74\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782422\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "d4a85f4749786ae186cafe0ac4af0c21a59cfb9d",
      "tree": "3c66c06a98bd6b6742525072e4abc4ae1cfba7c3",
      "parents": [
        "6f39c5226a445a99a6d90f9f29a76feefb1c401f"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 16:42:08 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:22:42 2026 -0700"
      },
      "message": "ssh/agent: limit RSA key size on Add requests\n\nparseRSAKey and parseRSACert build an rsa.PrivateKey directly from\nthe Add request body and then call priv.Precompute(). The CRT\ncoefficient recomputation in Precompute() is cubic in the size of\nthe prime factors, so accepting RSA keys with arbitrary modulus\nand prime sizes can consume excessive CPU resources during a\nsingle Add operation.\n\nAdd a checkRSAKeyParams helper that enforces the same bounds as\nparseRSA in the ssh package (modulus \u003c\u003d 8192 bits, exponent \u003c\u003d 24\nbits, exponent \u003e\u003d 3 and odd) plus a cap of 4096 bits on each prime\nfactor, and call it from both parseRSAKey and parseRSACert before\npriv.Precompute().\n\nThe previous inline check on the exponent (BitLen \u003e 30) is\nsubsumed by the new helper, which tightens it to BitLen \u003e 24 for\nconsistency with parseRSA.\n\nChange-Id: I6f0bbbfdc1db13d62a1f85e1d0e6ae517f000443\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782421\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "6f39c5226a445a99a6d90f9f29a76feefb1c401f",
      "tree": "0ce7f98d47315e0d9e69a55cacaf1deebec14525",
      "parents": [
        "4c4d20b72c2ffcc65325634d57021774dd2a1750"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 16:25:01 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Jun 02 00:22:37 2026 -0700"
      },
      "message": "ssh: limit RSA key size in OpenSSH private key parsing\n\nparseOpenSSHPrivateKey builds an rsa.PrivateKey directly from the\nunmarshalled OpenSSH key blob, bypassing parseRSA and its modulus\nlimit. Validate() and Precompute() then perform several modular\nexponentiations whose cost grows with the size of the prime factors;\nin particular Precompute() recomputes the CRT coefficient as\nq^(p-2) mod p, which is cubic in |p|. A maliciously crafted key with\noversized N and P can keep the CPU busy for hours or days during a\nsingle load.\n\nMirror the parseRSA validation here: cap the modulus at 8192 bits\n(the same limit enforced by crypto/tls), reject exponents larger than\n24 bits, and reject invalid exponent values (\u003c 3 or even). In addition,\nbound each prime factor at 4096 bits to prevent the CRT computation\nfrom becoming the dominant cost.\n\nThis issue was found during a security audit by NCC Group Cryptography\nServices, sponsored by Teleport, and was assessed and is being fixed as\na non-security bug.\n\nChange-Id: Ia5991f25dd41a22eddd7cf63a8fc5106de9e9663\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/782420\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "4c4d20b72c2ffcc65325634d57021774dd2a1750",
      "tree": "370e2c858141b4afd1154c9cccc04ccc0c9dbbd0",
      "parents": [
        "e3e62d9601ec6fa737c081aead768f525f919802"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Wed May 27 11:17:19 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 28 10:16:30 2026 -0700"
      },
      "message": "ssh: fix spinloop in mux SendRequest drain on closed channel\n\nThe drain loop added in 4e7a738 (\"ssh: fix deadlock on unexpected\nglobal responses\") receives from m.globalResponses without checking\nthe comma-ok flag. Once mux.loop closes globalResponses on connection\nteardown, the loop spins forever on the zero value, pinning a CPU\ncore for every concurrent SendRequest caller.\n\nUse the comma-ok idiom to detect the closed channel and break out.\n\nChange-Id: Icf0a7419fe5b206b7a4f70429fa9f25d0b5af731\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/783681\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\n"
    },
    {
      "commit": "e3e62d9601ec6fa737c081aead768f525f919802",
      "tree": "cb2d896c54c263e080ddaf10641339c1fef9d320",
      "parents": [
        "5adb68b3e6894a642e0f86712fcad2cd3e19c4e9"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Wed May 27 11:13:48 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 28 10:16:26 2026 -0700"
      },
      "message": "ssh: fix spinloop in channel SendRequest drain on closed channel\n\nThe drain loop added in 3c7c869 (\"ssh: fix deadlock on unexpected\nchannel responses\") receives from ch.msg without checking the comma-ok\nflag. Once ch.msg is closed by channel.close(), receives succeed\nimmediately with the zero value, so the default arm is never taken\nand the loop spins forever, pinning a CPU core for every concurrent\nSendRequest caller on a torn-down channel.\n\nUse the comma-ok idiom to detect the closed channel and break out.\n\nFixes golang/go#79658\n\nChange-Id: Id80aa5d8429550c7a68e8759aed9ffba3aabb006\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/783680\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nAuto-Submit: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n"
    },
    {
      "commit": "5adb68b3e6894a642e0f86712fcad2cd3e19c4e9",
      "tree": "9574d50338940540a96955179dc0dc5566304b9c",
      "parents": [
        "9beb694f9766a2c69fe6c89cfa6cf653a32b5a27"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun May 24 19:06:18 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Wed May 27 09:40:09 2026 -0700"
      },
      "message": "ssh: cap total userauth attempts per server connection\n\nserverAuthenticate only bounded real failures via MaxAuthTries.\nPartialSuccessError responses and the publickey isQuery short-circuit\nboth kept the loop running without incrementing authFailures, so a\nclient could keep the server processing SSH_MSG_USERAUTH_REQUEST\nmessages indefinitely on a single connection.\n\nAdd an unconditional cap, maxAuthServerAttempts \u003d 128, on the total\nnumber of userauth requests handled per connection. The counter is\nincremented at the top of the loop before method dispatch, so every\nmethod and every isQuery / partial-success path counts. When the cap\nis exceeded the server sends SSH_MSG_DISCONNECT with reason 2 (\"too\nmany authentication attempts\"), mirroring the MaxAuthTries handling.\nThe bound is well below OpenSSH\u0027s hard cap of 1024 but above any\nrealistic multi-step auth flow.\n\nChange-Id: I56779fc55cd00ddfd32ec938f8de3a49be0145dc\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781903\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n"
    },
    {
      "commit": "9beb694f9766a2c69fe6c89cfa6cf653a32b5a27",
      "tree": "ecce4f5d5b4b326896d82ca36ec146f506c813a7",
      "parents": [
        "e5306b2f3e9643bcc0ccac2034a48a294a68af74"
      ],
      "author": {
        "name": "Neal Patel",
        "email": "neal@golang.org",
        "time": "Tue May 19 20:31:25 2026 -0400"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "neal@golang.org",
        "time": "Mon May 25 19:49:21 2026 -0700"
      },
      "message": "ssh: prevent malformed exit-status panic\n\nA malicious server can crash any client by sending\na truncated exit-status payload, which triggers a\npanic in binary.BigEndian.Uint32.\n\nChange-Id: Iff4fe182b40210c99d46562f6c3b5ecf38bb98b4\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/780181\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "e5306b2f3e9643bcc0ccac2034a48a294a68af74",
      "tree": "08d503005cbd6ecd3d034d11d818625080417c1b",
      "parents": [
        "d2fe592df1852c42d472de6b51f6cb2fccb9171b"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Sun Apr 19 20:32:53 2026 +0200"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu May 21 19:39:50 2026 -0700"
      },
      "message": "ssh/agent: support parallel signing using request pipelining\n\nMake NewClient automatically pipeline concurrent requests over its\nconnection when the supplied io.ReadWriter also implements io.Closer.\nIn this mode the client writes requests to the wire as soon as the\nwrite path is available and dispatches responses back to callers in\nFIFO order via a dedicated reader goroutine, instead of fully\nserializing each call. Up to 32 requests may be in flight on a single\nconnection.\n\nThis lets an agent that load-balances signing across multiple backend\ndevices keep several of them busy concurrently without forcing callers\nto maintain their own connection pool. Aggregate throughput scales\nroughly linearly with the number of backend devices up to the\nin-flight cap; the protocol\u0027s in-order response requirement means\nslow requests still delay subsequent ones on the same connection,\nwhich is unchanged.\n\nThe pipelined path requires io.Closer because, on a Write error, the\nbackground reader goroutine must be unblocked by closing the\nunderlying connection; otherwise it would remain parked forever\nwaiting for a response that will never arrive, leaking the goroutine\nand desynchronising the FIFO routing of responses for subsequent\nsuccessful writes. When the supplied transport does not implement\nio.Closer, NewClient falls back to the previous fully-serialized\nbehavior: a single in-flight call at a time, with no background\ngoroutine.\n\nFixes golang/go#78473\n\nChange-Id: Icf14e5e8ca897506d68fb32c14fc72c774cd97b2\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/768483\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "d2fe592df1852c42d472de6b51f6cb2fccb9171b",
      "tree": "0cbf8b34e99bfcc7a66e0077fa0eb6fa70a058cf",
      "parents": [
        "d59570d1a3152c5998e3f9b4b757514412a1472e"
      ],
      "author": {
        "name": "ding",
        "email": "ding@diinngg.com",
        "time": "Mon Dec 29 14:13:05 2025 +0000"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu May 21 19:39:36 2026 -0700"
      },
      "message": "ssh: add openssh controlmaster socket support\n\nAdds support for establishing SSH sessions over an existing \"ControlMaster\" [unix domain] socket in proxy mode.\n\nDetails of the protocol can be found here: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.mux\nMore details about ControlMaster sockets can be found here: https://linux.die.net/man/5/ssh_config\n\nFixes golang/go#32958\n\nCo-authored-by: Cyrus Katrak \u003cckatrak@slack-corp.com\u003e\nChange-Id: Ia3ae8893262f5060ed3fadfcbe97619c9659145b\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/733040\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Nicola Murino \u003cnicola.murino@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\n"
    },
    {
      "commit": "d59570d1a3152c5998e3f9b4b757514412a1472e",
      "tree": "a582152c78bdf3cb2e5a05deec63d2289b9cc1b9",
      "parents": [
        "4aab0d9d6a195d489d47981f56bd3ecd08c98346"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Wed Mar 25 12:02:00 2026 +0100"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu May 21 19:36:57 2026 -0700"
      },
      "message": "ssh: add AuthCallback to ClientConfig\n\nAdd ClientAuthCallback, a hook invoked before each authentication\nattempt that allows the client to dynamically select an auth method\nbased on server capabilities, partial successes, or previous failures.\n\nclientAuthenticate tracks partial successes in a slice and passes\nthem to AuthCallback via ClientAuthContext.PartialSuccessMethods,\nalong with the list of failed methods and currently allowed methods.\nWhen AuthCallback returns a non-nil AuthMethod, it is used for the\nnext attempt, bypassing the static findNext selection. When it\nreturns (nil, nil), the static config.Auth selection proceeds as\nbefore. If AuthCallback returns (nil, error) the handshake aborts\nimmediately with that error.\n\nTo bound resource use when AuthCallback keeps supplying methods, the\nclient caps the total number of authentication attempts (failures and\npartial successes combined) at 64; exceeding the cap aborts the\nhandshake with an error.\n\nFixes golang/go#76146\n\nChange-Id: I0d02bea7b9dd724e95e5d9d49d85306666c0df7a\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/717140\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "4aab0d9d6a195d489d47981f56bd3ecd08c98346",
      "tree": "5d1d5e03a8afc1644c8b22d50653c0efd1350e8b",
      "parents": [
        "a1c0d9929856c8aba2b31f079340f00578eda803"
      ],
      "author": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Wed Mar 25 11:56:58 2026 +0100"
      },
      "committer": {
        "name": "Nicola Murino",
        "email": "nicola.murino@gmail.com",
        "time": "Thu May 21 19:36:47 2026 -0700"
      },
      "message": "ssh: return partial success immediately from publickey auth\n\nChange publicKeyCallback to return authPartialSuccess to the caller\nimmediately when a signer receives partial success, instead of\ncontinuing to try remaining signers internally.\n\nThe caller (clientAuthenticate) already handles authPartialSuccess\nby not adding the method to \"tried\", so findNext can re-select\npublickey on the next iteration. When it does, all signers are\ntried again from the beginning.\n\nChange-Id: Icc87721aa56ef59a357e409aa046640a27e5fc46\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/757900\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "a1c0d9929856c8aba2b31f079340f00578eda803",
      "tree": "fc8036ec469d294974c26ffbce23242fd5bf0dbc",
      "parents": [
        "3c7c86938f4541c333d506f719388d9c42d4763d"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 17:13:39 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 17:26:06 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Ia739869d49c750c7fa578b9dbd7bb998d8c87087\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781683\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "3c7c86938f4541c333d506f719388d9c42d4763d",
      "tree": "abbec0c2c675deca1dde3d637acb2aa06901f63d",
      "parents": [
        "533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce"
      ],
      "author": {
        "name": "Nicola",
        "email": "nicola.murino@gmail.com",
        "time": "Tue Apr 21 21:43:00 2026 +0200"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Thu May 21 17:09:12 2026 -0700"
      },
      "message": "ssh: fix deadlock on unexpected channel responses\n\nPreviously, channel.handlePacket sent channelRequestSuccess and\nchannelRequestFailure messages to ch.msg unconditionally via the default\narm of its type switch. Because ch.msg is a bounded buffer (chanSize),\na peer that sends a burst of unsolicited channel request responses for\nan open, idle channel fills the buffer and blocks the mux read loop on\nthe next send. That stalls all packet processing on the connection,\nand because readLoop then backs up on t.incoming, closing the\nunderlying net.Conn does not unblock either goroutine: user code\nobserves Close() returning promptly while Wait() hangs and the mux,\nreadLoop, and kexLoop goroutines leak permanently.\n\nThis change mirrors the fix for the mux-level SendRequest path: a\nsentRequestPending atomic gate is set while a SendRequest with\nWantReply is in flight, handlePacket drops responses when the gate is\nclosed, and uses a non-blocking send otherwise. SendRequest drains\nany spurious response that slipped through before discarding it, so\nthe caller always observes the reply to its own request.\n\nThis aligns with OpenSSH, which silently ignores channel confirm\nmessages that do not match a pending request.\n\nFixes golang/go#79564\nFixes CVE-2026-39830\n\nChange-Id: I15e2add4bf7876bb0c6f921f8b57203d97e83f47\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781664\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce",
      "tree": "2215c94ae92c2aea2cc51e5e7bca2e4972fb14f8",
      "parents": [
        "abbc44d451a6f9236a2bbd26cbcd4d0fec473da3"
      ],
      "author": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Fri May 15 19:57:52 2026 +0000"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "nealpatel@google.com",
        "time": "Thu May 21 17:03:26 2026 -0700"
      },
      "message": "ssh: fix source-address critical option bypass\n\nPreviously, CVE-2024-45337 fixed an authorization bypass\nfor misused ssh server configurations; if any other type\nof callback is passed other than public key, then the\nsource-address validation would be skipped.\n\nFixes CVE-2026-46595\nFixes golang/go#79570\n\nChange-Id: I08d86a961048a232c8672f23000e693ed5a0e2fd\nReviewed-on: https://go-review.googlesource.com/c/crypto/+/781642\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Roland Shoemaker \u003croland@golang.org\u003e\n"
    }
  ],
  "next": "abbc44d451a6f9236a2bbd26cbcd4d0fec473da3"
}