)]}'
{
  "commit": "1952e618b834bda60fb9efff0fc0af46b38e110d",
  "tree": "6ea581969a0456f63ee7a217e843e92196afa85c",
  "parents": [
    "2e82d2ce86ab4af48b3bb3f9e92a36621365f5b6"
  ],
  "author": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Wed Jun 24 15:24:36 2026 -0700"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Tue Jun 30 16:12:01 2026 -0700"
  },
  "message": "net/http: apply header timeout to server\u0027s unencrypted HTTP/2 check\n\nWhen a server is configured to support unencrypted HTTP/2,\nit reads a few bytes from each new connection to see if they\ncontain the HTTP/2 client preface. This read was being done\nwith no timeout applied. Apply the header timeout (since this\nis essentially reading the first headers from the connection).\n\nHoist the header timeout into the server serve loop so we can\nuse a single timeout to cover both the HTTP/2 preface and\nthe first HTTP/1 headers.\n\nThanks to Vsevolod Naumov and Ainar Garipov from AdGuard for reporting this issue.\n\nFixes #80205\nFixes CVE-2026-56853\n\nChange-Id: I69943a79453967bc2f70da5b5ceeac936a6a6964\nReviewed-on: https://go-review.googlesource.com/c/go/+/795540\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "1205e8be945527e30677ff8de586c1bb303178f9",
      "old_mode": 33188,
      "old_path": "src/net/http/serve_test.go",
      "new_id": "d879300f35c09f7d61bc85402d059f39034d0c7d",
      "new_mode": 33188,
      "new_path": "src/net/http/serve_test.go"
    },
    {
      "type": "modify",
      "old_id": "058c42d13c4853e9695d7db28700b74081f6a489",
      "old_mode": 33188,
      "old_path": "src/net/http/server.go",
      "new_id": "2c28abd045854ebbfb7f21c305ee84d1aff86a11",
      "new_mode": 33188,
      "new_path": "src/net/http/server.go"
    }
  ]
}