)]}'
{
  "commit": "b18ca70b8dfd0224b6387083db8ba5231d8ac900",
  "tree": "ecce4b4fa7417221d5862a7b7c0525816730a1df",
  "parents": [
    "278a55c1b44afc7b6c3d127555546e9658d2fd27"
  ],
  "author": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Thu Apr 30 13:10:49 2026 -0700"
  },
  "committer": {
    "name": "Gopher Robot",
    "email": "gobot@golang.org",
    "time": "Thu May 07 07:33:04 2026 -0700"
  },
  "message": "[release-branch.go1.25] cmd/go: reject sumdb response lacking module hash\n\nReport an error when a sumdb /lookup/ request does not\ninclude a hash for the requested module, rather than\nsilently proceeding.\n\nPreviously, we would verify that a returned sum matched\nthe expected module hash, but did not verify that the\nresponse contained a sum. This permits a malicous\nproxy to serve a corrupted module along with a\nvalid-but-irrelevant sumdb response for some other\nmodule. We now ensure that the sumdb response contains\na valid hash for the module we are validating.\n\nThanks to Mundur (https://github.com/M0nd0R) for reporting this issue.\n\nFixes CVE-2026-42501\nUpdates #79070\nFixes #79072\n\nChange-Id: I7d9a367deb237aa70cade2434495998f6a6a6964\nReviewed-on: https://go-internal-review.googlesource.com/c/go/+/4340\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-on: https://go-internal-review.googlesource.com/c/go/+/4421\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/go/+/775161\nTryBot-Bypass: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Michael Pratt \u003cmpratt@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5d310ccbba90fa402d29b18db5d4fc93f4856dbe",
      "old_mode": 33188,
      "old_path": "src/cmd/go/internal/modfetch/fetch.go",
      "new_id": "41e02e72dab6f4317c0daaa0a533f19f1c37c2b8",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/modfetch/fetch.go"
    },
    {
      "type": "modify",
      "old_id": "5ff81361c9609aaf3e72cf4fe142a1fe95bc499a",
      "old_mode": 33188,
      "old_path": "src/cmd/go/proxy_test.go",
      "new_id": "2a8bacec1868199ec35bbc22e9cadd961b55d9b3",
      "new_mode": 33188,
      "new_path": "src/cmd/go/proxy_test.go"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "c2dd814542d671ffeff9326ad5841a73eea5ff79",
      "new_mode": 33188,
      "new_path": "src/cmd/go/testdata/script/mod_sum_absent.txt"
    }
  ]
}