)]}'
{
  "commit": "463165699d874ef0ac7965fc5788fe1693eaae9a",
  "tree": "ee465e3ba1319e36f101cd940af55d4af165346c",
  "parents": [
    "5ede095649db7783726c28390812bca9ce2c684a"
  ],
  "author": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Thu Sep 25 14:41:53 2025 -0700"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Tue Oct 07 12:46:33 2025 -0700"
  },
  "message": "net/mail: avoid quadratic behavior in mail address parsing\n\nRFC 5322 domain-literal parsing built the dtext value one character\nat a time with string concatenation, resulting in excessive\nresource consumption when parsing very large domain-literal values.\n\nReplace with a subslice.\n\nBenchmark not included in this CL because it\u0027s too narrow to be\nof general ongoing use, but for:\n\n    ParseAddress(\"alice@[\" + strings.Repeat(\"a\", 0x40000) + \"]\")\n\ngoos: darwin\ngoarch: arm64\npkg: net/mail\ncpu: Apple M4 Pro\n                │  /tmp/bench.0  │            /tmp/bench.1             │\n                │     sec/op     │   sec/op     vs base                │\nParseAddress-14   1987.732m ± 9%   1.524m ± 5%  -99.92% (p\u003d0.000 n\u003d10)\n\n                │   /tmp/bench.0   │             /tmp/bench.1              │\n                │       B/op       │     B/op      vs base                 │\nParseAddress-14   33692.767Mi ± 0%   1.282Mi ± 0%  -100.00% (p\u003d0.000 n\u003d10)\n\n                │  /tmp/bench.0  │            /tmp/bench.1            │\n                │   allocs/op    │ allocs/op   vs base                │\nParseAddress-14   263711.00 ± 0%   17.00 ± 0%  -99.99% (p\u003d0.000 n\u003d10)\n\nThanks to Philippe Antoine (Catena cyber) for reporting this issue.\n\nFixes CVE-2025-61725\nFixes #75680\n\nChange-Id: Id971c2d5b59882bb476e22fceb7e01ec08234bb7\nReviewed-on: https://go-internal-review.googlesource.com/c/go/+/2840\nReviewed-by: Roland Shoemaker \u003cbracewell@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/go/+/709860\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\nTryBot-Bypass: Michael Pratt \u003cmpratt@google.com\u003e\nAuto-Submit: Michael Pratt \u003cmpratt@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "14f839a03077c1931d5f753681a17544dc97adbd",
      "old_mode": 33188,
      "old_path": "src/net/mail/message.go",
      "new_id": "1502b3596252ba4a06d5bee748eae5eb8c3ea267",
      "new_mode": 33188,
      "new_path": "src/net/mail/message.go"
    }
  ]
}