)]}'
{
  "log": [
    {
      "commit": "520c891fe60b2ffd4b4ee349d95cac4c1c0d9ee1",
      "tree": "ab643654266d93e39c6362e9b7b0771dbd7c9c25",
      "parents": [
        "656874fd46a65a97eac94003e0eb8751be4403d0"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 10 19:19:17 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Sep 18 15:36:59 2026 -0700"
      },
      "message": "quic: off-path support in loss/congestion/rtt\n\nPackets sent on one path must not affect congestion control and \nRTT estimates for other paths. Add support for distinguishing\nbetween on-path packets sent on the currently active path,\nand off-path packets sent on any other path.\n\nProbing packets can be sent off-path to validate a path.\n\nAfter address migration, all packets sent on the previous\npath become off-path.\n\nChange-Id: I345e785343c6b982cb0d4157bf77d7fb6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/832366\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "656874fd46a65a97eac94003e0eb8751be4403d0",
      "tree": "147ea8b2ac833cab675c871db2140b2052eab3b4",
      "parents": [
        "a818e160ee8fbf01b12286ff806fab82f0ed764f"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 10 16:03:26 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 15 13:55:17 2026 -0700"
      },
      "message": "quic: determine local address for connections\n\nProperly handling path migration requires QUIC connections to know\nboth the address they are sending from and the address they are\nsending to.\n\nDetermine the local address for a path by creating a temporary UDP\nsocket bound to the path; this sends no packets but lets us see\nwhat address the kernel thinks should be used on the path.\n(When using a non-*net.UDPConn connection, we don\u0027t attempt to do\nthis on the theory that our PacketConn likely doesn\u0027t use the real\nnetwork.)\n\nUpdate fake-network tests to use valid source/destination addresses\nfor all datagrams.\n\nChange-Id: Ia89f7daf479b10df4c1d23f3e64ad3726a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/832365\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "a818e160ee8fbf01b12286ff806fab82f0ed764f",
      "tree": "2317aaf8c7bffd8f32d565e2b2c3745b7f588121",
      "parents": [
        "f557b1863b98a9c5a91f9c871c98b07cfc3558ac"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Sep 10 15:12:35 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 15 12:47:50 2026 -0700"
      },
      "message": "quic: add a pathAddrs type, holding a local/peer address pair\n\nMost of the time we\u0027re interested in the combination of\nlocal and peer address, so make it easy to treat them\nas a set.\n\nChange-Id: I75e57fe417a7781f0c44a7121dc9ed6d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/832364\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "f557b1863b98a9c5a91f9c871c98b07cfc3558ac",
      "tree": "1df09043a9be0e6b7d355aaf9c6a24dc66e639f6",
      "parents": [
        "53e34cd8c56120ce92ef5ee7c4cd8510f57f6e8b"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 11 15:33:43 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 11 20:29:16 2026 -0700"
      },
      "message": "internal/http3, internal/httpcommon: move gzip reader implementation\n\nThis is the x/net counterpart of CL 831344.\n\nLegacy HTTP/2 implementation in x/net can technically use the shared\ngzip reader implementation too. However, since the package is frozen,\nleave it be.\n\nFor golang/go#81473\n\nChange-Id: Ia8663ecea8013abaa5c1f53dc58bdbd86a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/831364\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "53e34cd8c56120ce92ef5ee7c4cd8510f57f6e8b",
      "tree": "254277de1ec4b5b3a6f412223de02f00f250d0e8",
      "parents": [
        "540d04cfe5028e2655754591a4d3e08c586809f2"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Sep 09 16:02:02 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Sep 09 16:15:12 2026 -0700"
      },
      "message": "http2: drop benchmarks\n\nAlready don\u0027t exist on go1.27+, but panic on go1.26 due to trying to\nsynctest.Wait outside a bubble. Just delete them.\n\nFixes golang/go#81399\n\nChange-Id: I656f94e56b81a7864202a41499f779176a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/830344\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "540d04cfe5028e2655754591a4d3e08c586809f2",
      "tree": "1c082543aaddc170115860ee54204ff5d4601e28",
      "parents": [
        "20eef7fe493df0e014a996c5432e177a76987b84"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 08 11:33:30 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Sep 08 12:18:02 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: Ie0d34baf705908a88b9d224714dd4b6063987a02\nReviewed-on: https://go-review.googlesource.com/c/net/+/829344\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "20eef7fe493df0e014a996c5432e177a76987b84",
      "tree": "52157db8a28918516b56f4461d9b900130835f8b",
      "parents": [
        "c23af1b9b8cc40d792e7ffd20aa02bfb8984a1f5"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 04 13:27:46 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Sep 07 12:59:47 2026 -0700"
      },
      "message": "quic: clear fast-path receive buffer on stream reset\n\nWhen a stream is reset by the peer, unread stream data is discarded and\nits underlying memory buffers are returned to a pool for reuse. However,\nthe stream\u0027s fast-path read buffer was not cleared when the stream was\nreset, leaving a dangling reference to the recycled memory. This\nsurfaced as a data race in one of our HTTP/3 tests.\n\nTherefore, make sure that the fast-path read buffer is cleared when a\nstream is reset. Also do the same when STOP_SENDING frame is sent, where\nan equivalent bug exists.\n\nFor golang/go#70914\nFor golang/go#81349\n\nChange-Id: Ie1d75b646baa59804380feeb84ac0ff26a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/827804\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "c23af1b9b8cc40d792e7ffd20aa02bfb8984a1f5",
      "tree": "203dec29735ec684a1fdedf337879c6ac3a6b4fc",
      "parents": [
        "eda109f56e86afc41ee941c810e5e4e49f901ec3"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri Sep 04 16:07:49 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Sep 04 14:55:52 2026 -0700"
      },
      "message": "internal/http3: fix compilation error due to missed symbol name update\n\nCL 825004 updated quic.StreamErrorCode to quic.StreamError. However, one\nusage of quic.StreamErrorCode was not updated somehow, presumably due to\nmultiple CLs being sent and merged concurrently.\n\nChange-Id: Ifd9155aaeb186e428258a4f60a122e3e6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/827805\nAuto-Submit: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "eda109f56e86afc41ee941c810e5e4e49f901ec3",
      "tree": "b74f492f33b93dd7e32e55566c01d7cb14ed861f",
      "parents": [
        "12e0501290cb42609218b4818c97566c221de4c2"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 31 20:25:56 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Sep 01 13:50:07 2026 -0700"
      },
      "message": "internal/http3: send appropriate error codes in STOP_SENDING frames\n\nNow that the quic package supports setting an error code for\nSTOP_SENDING frames, update the HTTP/3 layer accordingly.\n\nFor golang/go#70914\n\nChange-Id: I0f439c685e4fda883dddeb92fae78ddc6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/825364\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\n"
    },
    {
      "commit": "12e0501290cb42609218b4818c97566c221de4c2",
      "tree": "535a8fae7b9ad92dae6c02bab01ff9434a596765",
      "parents": [
        "d89285e91501dd797ddcc984ed09fc71f12c0af0"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 31 15:16:21 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Sep 01 11:28:30 2026 -0700"
      },
      "message": "internal/http3: server header size limits\n\nApply Server.MaxHeaderBytes.\n\nIncludes commented-out support for MaxHeaderValueCount.\nIt\u0027s probably not worth using build tags to make this conditional\non go 1.27, so just leave it out for the moment.\n\nChange-Id: I6452b6aba3336d48ebb877621ebecb7e6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/825264\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "d89285e91501dd797ddcc984ed09fc71f12c0af0",
      "tree": "f92a0986778cb1724d530b657f2f2ba6cf3b7ea5",
      "parents": [
        "d34deae423f98518a84a3735ab82e3e031a375fb"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 31 11:28:16 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Aug 31 15:44:11 2026 -0700"
      },
      "message": "quic: add Stream.StopSending, and rework stream/application errors\n\nRename StreamErrorCode to StreamError, to maintain the convention that\nerror type names end with \"Error\".\n\nRename ApplicationError to ConnectionCloseError, to distinguish it\nfrom StreamError.\n\nAdd a Stream.StopSending method, which is Stream.CloseRead but permits\nsetting the application error code to send.\n\nAdd an error return value to Stream.CloseRead and Stream.CloseWrite,\nto match the signature of net package methods with these names.\n\nChange-Id: Ie84b4b0b874636deae8adc9de26e90886a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/825004\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "d34deae423f98518a84a3735ab82e3e031a375fb",
      "tree": "14d0e60dcd978a40f8fabbb2c067ad33d52c93ed",
      "parents": [
        "55577aaeb84956beaf8ecbd12491a2774c33169c"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Thu Aug 27 22:50:27 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Fri Aug 28 12:28:15 2026 -0700"
      },
      "message": "quic: ensure Endpoint.Close waits for connection loops to exit\n\nIn CL 822984, Endpoint.Close was modified to only return when its listen\nloop has actually exited.\n\nHowever, if Endpoint.packetConn is closed prior to Endpoint.Close being\ncalled (as in the case of net/http), Endpoint.Close can still return\nprematurely before all connection loops exit.\n\nFix this by making sure that we also wait for all connection loops to\nexit.\n\nFor golang/go#70914\n\nChange-Id: I7dbc985475e845c89e2fa9a7755718326a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/823524\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "55577aaeb84956beaf8ecbd12491a2774c33169c",
      "tree": "ae836f7622dce1e4664b80f5875f3bdabeb3c6f2",
      "parents": [
        "b22627e5363920905c17b5e37e10d2b0329972ec"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Aug 21 11:46:14 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Aug 27 18:50:20 2026 -0700"
      },
      "message": "http2: use IDNA Lookup profile, not raw Punycode translation\n\nFor golang/go#81010\n\nChange-Id: I184386da6e62b5cc4108537f297191436a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/819201\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b22627e5363920905c17b5e37e10d2b0329972ec",
      "tree": "6e636031b31447534dc4926058de96d3bb812cb5",
      "parents": [
        "6e98b0dc709b77cf047bee24a08232937ea78bab"
      ],
      "author": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 11:26:21 2026 -0400"
      },
      "committer": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 18:28:42 2026 -0700"
      },
      "message": "internal/http3: handle a nil TLSConfig in newQUICConfig\n\nnewQUICConfig read tlsConfig.NextProtos before checking tlsConfig for nil, so\na nil tls.Config panicked. The nil check that followed, after tlsConfig.Clone(),\nwas unreachable.\n\nThis is reachable from initEndpoint, which passes http.Transport.TLSClientConfig\nstraight through, and that field is nil for a default Transport:\n\n    panic: runtime error: invalid memory address or nil pointer dereference\n        golang.org/x/net/internal/http3.newQUICConfig(...)\n        golang.org/x/net/internal/http3.(*transport).initEndpoint(...)\n\nChange-Id: I8b8dcb56a2ffc148a03894335f9d74196a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/823105\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "6e98b0dc709b77cf047bee24a08232937ea78bab",
      "tree": "b8c980b2df3218744c68f57b217c5fa43a16a202",
      "parents": [
        "980ca2df21e0ad4bf2b1f1423dcb90572b5b1029"
      ],
      "author": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 11:22:23 2026 -0400"
      },
      "committer": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 18:28:30 2026 -0700"
      },
      "message": "internal/http3: report endpoint creation errors from initEndpoint\n\nFix err shadow bug.\n\nChange-Id: Id66e8bb3d94cb9ff36c94f5bb74242b66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/823104\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "980ca2df21e0ad4bf2b1f1423dcb90572b5b1029",
      "tree": "22276d6a0a6aec1297768cb085fb0bace2eaffd0",
      "parents": [
        "54909996cab9290184de742137eaea939da894e9"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Thu Aug 27 09:43:44 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu Aug 27 12:25:20 2026 -0700"
      },
      "message": "quic: make Endpoint.Close return only when the endpoint is actually closed\n\nWhen the context passed to Endpoint.Close has been canceled, it will\ncorrectly abort any active connections immediately, without waiting for\npeer acknowledgement. However, in doing so, Endpoint.Close will\nimmediately return without waiting for its listen loop to actually exit.\nAs a result, callers such as our HTTP/3 implementation cannot know\nwhether the endpoint is actually completely closed or not, and the\nendpoint might be detected as a goroutine leak in tests.\n\nFor golang/go#70914\nFor golang/go#78701\n\nChange-Id: Idd67ae200305001be336da50f1794c716a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/822984\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "54909996cab9290184de742137eaea939da894e9",
      "tree": "bdf22f5ee95e293d8e89c6d29cd1b1ade2ba4817",
      "parents": [
        "f3ca0345eec60477f21b1c75d5772f2f19acbd73"
      ],
      "author": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 09:22:53 2026 -0400"
      },
      "committer": {
        "name": "Russ Cox",
        "email": "rsc@golang.org",
        "time": "Thu Aug 27 11:24:01 2026 -0700"
      },
      "message": "internal/http3: close the request body before RoundTrip returns\n\nwriteBodyAndTrailer runs in its own goroutine and closes Request.Body from a\ndeferred call, so RoundTrip could return while that close was still in\nprogress. Nothing else closed the body in that case: net/http wraps the body\nin a readTrackingBody whose Close sets didClose before calling the underlying\nClose, and Transport.roundTrip skips its own req.closeBody() once didClose is\nset. A caller inspecting the body as soon as RoundTrip returned could\ntherefore observe that it had never been closed:\n\n    client_test.go:2088: close calls \u003d 0; want 1\n    transport_test.go:4242: didn\u0027t see Body.Close\n\nWait for writeBodyAndTrailer to finish with the body before returning an\nerror, closing the body first so that a writeBodyAndTrailer blocked reading\nfrom it wakes up. The HTTP/2 transport does the same thing for the same\nreason; see golang/go#60041.\n\nClosing the body on the error path also covers the case where\nwriteBodyAndTrailer was never started, which happens when a request sends\n\"Expect: 100-continue\" and the server answers with a final status.\n\nFixes golang/go#81108.\nFixes golang/go#81148.\n\nChange-Id: Ib4d361b451a7295b1875ef5a10d4fde26a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/822944\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "f3ca0345eec60477f21b1c75d5772f2f19acbd73",
      "tree": "989af9b8e6b32c5ec7d4ad0d008fd5cea8a63323",
      "parents": [
        "a3752289cad6b778a73fa6ee9163604d0c55aec1"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Sat Aug 22 17:28:46 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 26 21:37:56 2026 -0700"
      },
      "message": "http2: deprecate Transport and Server\n\nFixes golang/go#78064\n\nChange-Id: Ia8f5c109b4594ef5a4fca1eacfc0f2da6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/819740\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "a3752289cad6b778a73fa6ee9163604d0c55aec1",
      "tree": "98c0a6e50276958d30b1912689c427c8390ccb6f",
      "parents": [
        "679e2dbb6f744eef63600214a2a1a74942837ab0"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Aug 25 20:07:50 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 26 21:18:26 2026 -0700"
      },
      "message": "internal/http3: do not abort roundtrip when server closes request stream\n\nPer RFC 9114 Section 4.1, a server might opt to ignore some part of a\nrequest if it can construct a response without the unsent part of the\nrequest.\n\nCurrently, our transport always aborts a roundtrip when we try to write\na request body to a stream that has been reset. As a result, when a\nserver returns a response early, roundtrip erroneously fails. This seems\nto be the cause of flakes in std tests, where we are failing due to\n\"writing request body: write to reset stream\".\n\nFix this issue by making sure the transport will gracefully stop writing\nwhen a server ignores its request, indicated by STOP_SENDING frame\ncontaining H3_NO_ERROR error code. In our QUIC implementation, the\nSTOP_SENDING frame currently contains error code 0 rather than\nH3_NO_ERROR due to an existing TODO. For now, also accept error code 0;\nmodifying QUIC to send H3_NO_ERROR error code will be done in a separate\nCL.\n\nFor golang/go#70914\nFor golang/go#81079\nFor golang/go#81085\nFor golang/go#81088\nFor golang/go#81094\nFor golang/go#81105\n\nChange-Id: I980f6966a41873f1a96fd93d3d3084d66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/821920\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "679e2dbb6f744eef63600214a2a1a74942837ab0",
      "tree": "15c059fa0835ed0557b35c67885a0d101022a10d",
      "parents": [
        "af341ad5e59a6b68d5ff7b0c860e3d8f7e201a9b"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 24 15:05:55 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Aug 26 21:08:42 2026 -0700"
      },
      "message": "quic: don\u0027t exceed anti-amp limit with Initial padding\n\nWhen the anti-amplification limit is less than 1200 bytes,\nwe can not send a padded Initial packet. Detect and handle this case.\n\nFixes golang/go#81082\n\nChange-Id: Ib56a6cfeca1084a0bb8d1efc79ee95946a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/820680\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "af341ad5e59a6b68d5ff7b0c860e3d8f7e201a9b",
      "tree": "2ab25aff83c9e33d9c29b797fc1b9a199f2c18cf",
      "parents": [
        "bf481657f8f2118587dddc63b9f389f2243a5358"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 26 15:15:02 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 26 14:17:44 2026 -0700"
      },
      "message": "internal/http3: do not treat 1xx status as the final response status\n\nTestServer1xxExpect100ContinueRace is flaky for HTTP/3 in std. This is\nbecause duplicate status 100 can cause the HTTP/3 transport to\naccidentally treat 100 as the final response status.\n\nMake sure that 1xx headers are always treated as informational status\nrather than the final status.\n\nFor golang/go#70914\nFor golang/go#81119\n\nChange-Id: Id834c403ae565ed00aa03ac89f69b7286a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/822544\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "bf481657f8f2118587dddc63b9f389f2243a5358",
      "tree": "08b796de226eec80a391dfaeb9cda6fb0a6935e5",
      "parents": [
        "7f141996eacac4646d12ec23d96694361a1e2600"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 24 14:57:07 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Aug 25 15:24:30 2026 -0700"
      },
      "message": "internal/http3: wait until clientConn is unregistered when closing it\n\nThe longtest in std is currently failing due to lingering goroutines at\nthe end of tests. This seems to be occurring due to CloseIdleConnections\nbeing called before the clientConn had the chance to be fully\nunregistered from the transport. This results in CloseIdleConnections\nbeing unable to close the QUIC endpoint (thinking that there are still\nactive connections).\n\nMake sure that clientConn.Close only returns after clientConn is\nunregistered from the transport to fix this.\n\nUnfortunately, this race condition seems to occur only when testing in\nstd using fakenet. Therefore, no tests in this CL for now.\n\nFor golang/go#78701\nFor golang/go#70914\n\nChange-Id: I35c66b3e843be5f53ceef602d0ac456f6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/820540\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "7f141996eacac4646d12ec23d96694361a1e2600",
      "tree": "59ac5e86b91f25ce91310f8f23410d6131168090",
      "parents": [
        "fc715e5c972bf4ec70ca609630538e6b71d6480c"
      ],
      "author": {
        "name": "Tobias Klauser",
        "email": "tklauser@distanz.ch",
        "time": "Tue Aug 25 12:04:04 2026 +0200"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 25 07:18:31 2026 -0700"
      },
      "message": "all: use min/max builtins\n\nChange-Id: I2c9db8f6260bb5b1d745b49bcc5edbae17007851\nReviewed-on: https://go-review.googlesource.com/c/net/+/821080\nReviewed-by: Jorropo \u003cjorropo.pgm@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nAuto-Submit: Tobias Klauser \u003ctobias.klauser@gmail.com\u003e\n"
    },
    {
      "commit": "fc715e5c972bf4ec70ca609630538e6b71d6480c",
      "tree": "edd47bbee15f8956db1a90ef898bbb82d9aeb744",
      "parents": [
        "37f3d6f02f416ee4b2e752493f052ccdcd2df450"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 19 17:56:37 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 19 19:46:10 2026 -0700"
      },
      "message": "internal/http3: include minor HTTP version in default User-Agent header\n\nHTTP/1 and HTTP/2 transports include the minor version in their default\nUser-Agent header. Do so for HTTP/3 too for consistency.\n\nFor golang/go#70914\n\nChange-Id: I750bf9a21bef28594262c33349940d856a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/817121\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "37f3d6f02f416ee4b2e752493f052ccdcd2df450",
      "tree": "3735157f7515a0bcf00da7a6c965b0b8a8a235b6",
      "parents": [
        "f6c404bf8371cea2a96e5bf2075b6f5a3b06657c"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 19 16:59:34 2026 +0000"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 19 10:26:06 2026 -0700"
      },
      "message": "all: upgrade go directive to at least 1.26.0 [generated]\n\nBy now Go 1.27.0 has been released, and Go 1.25 is no longer supported\nper the Go Release Policy (see https://go.dev/doc/devel/release#policy).\n\nSee https://go.dev/doc/godebug#go-126 for GODEBUG setting changes\nrelevant to Go 1.26.\n\nFor golang/go#69095.\n\n[git-generate]\n(cd . \u0026\u0026 go get go@1.26.0 \u0026\u0026 go mod tidy)\n\nChange-Id: I902f0e83fde8c990231c42e01e48aa7721785ed1\nReviewed-on: https://go-review.googlesource.com/c/net/+/817840\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Carlos Amedee \u003ccarlos@golang.org\u003e\n"
    },
    {
      "commit": "f6c404bf8371cea2a96e5bf2075b6f5a3b06657c",
      "tree": "9dddb1824bbe77f4b08bebaec503acd4139dff6b",
      "parents": [
        "c354d3f669cd33e14548d5359f52fbf842daed39"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Aug 17 09:54:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Aug 17 11:11:09 2026 -0700"
      },
      "message": "http2/h2c: restore documentation of NewHandler unsafety\n\nAdd the warning about NewHandler reading an entire request into memory back\ninto the documentation. (Lost when replacing the prior docs with a terse\ndeprecation notice.)\n\nChange-Id: I13468b2c63a58599ced9f322a2feb36b6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/816540\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "c354d3f669cd33e14548d5359f52fbf842daed39",
      "tree": "2e92ba40f03491c5458836a074d77e557b3b169c",
      "parents": [
        "580cba3e41a458046860750d77727ed935b94a77"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Aug 12 09:49:48 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Aug 14 09:05:56 2026 -0700"
      },
      "message": "internal/httpcommon: remove Host header from server request\n\nThe http.Request documentation states:\n\n\t// For incoming requests, the Host header is promoted to the\n\t// Request.Host field and removed from the Header map.\n\nMake our behavior match the documentation.\nPreviously, we would include a Host header in the Header map when\nthe sender sends no :authority pseudo-header, but does send a host header.\n\nFor golang/go#80066\n\nChange-Id: I92ad651321a4a87a74a8449a02d02a776a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/814080\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "580cba3e41a458046860750d77727ed935b94a77",
      "tree": "a9199483183162171ff6dcabcb934b379b68d784",
      "parents": [
        "21c1020e630b338daf30f7d909311a299699d522"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Aug 11 14:18:46 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 12 11:57:36 2026 -0700"
      },
      "message": "http3, internal/httpcommon: improve :authority/host header interactions\n\nImplement a variety of checks and behaviors involving the :authority\npseudo-header and the Host header.\n\nWhen both are present, both must match.\nThere may be no more than one Host header.\nWhen there is Host and no :authority, use Host as the authority.\nValidate the authority contents (same rules as used by HTTP/1 servers).\n\nFor golang/go#80065\n\nChange-Id: I01bfd826f4139384bd7910fc59a4109b6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/813520\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "21c1020e630b338daf30f7d909311a299699d522",
      "tree": "a0f66bea2cf9718fa384456679d8c242bcd502de",
      "parents": [
        "acc78e0d2b2c855c0c4fbdcfe5f42a9e3d0f9778"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Aug 11 15:43:36 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 12 11:09:59 2026 -0700"
      },
      "message": "internal/httpcommon: drop net/http dependency in tests\n\nPermits us to copy the tests into std as well.\n\nChange-Id: Iee5672b00a39e4d785f0f11a148cf9396a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/813580\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "acc78e0d2b2c855c0c4fbdcfe5f42a9e3d0f9778",
      "tree": "85f3687cfc2b986b2b0d85f6aa22de7264539abf",
      "parents": [
        "90d10f01d98d92403c7b2823ab62a977cd01c7c6"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 11 11:17:28 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Aug 12 10:41:32 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I79a762b016aa660c10f8c05557a79b05e98f695b\nReviewed-on: https://go-review.googlesource.com/c/net/+/813281\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "90d10f01d98d92403c7b2823ab62a977cd01c7c6",
      "tree": "38f7e621537609b0dbd2e3f033b08c15eb6807b1",
      "parents": [
        "08abf4d948c22eae54ea207977c8ee700412a442"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Aug 11 17:53:55 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Aug 12 10:12:10 2026 -0700"
      },
      "message": "internal/http3: delete invalid Content-Length if declared in server handler\n\nFollowing our HTTP/1 and HTTP/2 server implementations, when a\nContent-Length header is set to an invalid value in a server handler, it\nshould be stripped.\n\nAlso change responseWriter.bodyLenLeft to be int64, to avoid possible\noverflow shenanigan on 32-bit systems.\n\nFor golang/go#70914\n\nChange-Id: I76174d81e7b5993b62a32235ba5008f76a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/813560\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "08abf4d948c22eae54ea207977c8ee700412a442",
      "tree": "c18d3d9e34a63202e1c0da5bf85d735b2adad31c",
      "parents": [
        "8d10596d262406469433c798878f7a33b1a8d6c4"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 10 12:32:42 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Aug 10 15:41:33 2026 -0700"
      },
      "message": "internal/http3: infer headers when Content-Encoding is set but is empty\n\nTestContentEncodingNoSniffing in std verifies that when a\nContent-Encoding header is set to an empty value, it is considered as if\nthe header is not set at all, and that Content-Type header should be\ninferred.\n\nMake HTTP/3 behave similarly to HTTP/1 and HTTP/2 implementations in\nthis regard.\n\nFor golang/go#70914\n\nChange-Id: Icbb60fd00f182c1ddc4e2372e4d2e4686a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/812760\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "8d10596d262406469433c798878f7a33b1a8d6c4",
      "tree": "7e74a3aae5c2582c64dc7a52e61f9d5173cb6612",
      "parents": [
        "99c3b0a8f463fdf9bfde3b2cb50599ee53891eb0"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Sat Aug 01 09:12:13 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Aug 04 12:21:08 2026 -0700"
      },
      "message": "http2: avoid deadlocks in wrapped ClientConn state callback\n\nAn http2.ClientConn wraps an http.ClientConn.\nThe http.ClientConn calls back to the http2.ClientConn\u0027s\nstate hook on certain state changes.\n\nSince the state hook acquires the http2.ClientConn\u0027s mutex,\nholding the mutex while calling an http.ClientConn method\nwhich can trigger a state hook call can cause a deadlock.\n\nAvoid deadlocks in two places where the http2.ClientConn\nheld its mutex while calling http.ClientConn.Reserve.\n\nFixes golang/go#80680\n\nChange-Id: I9b4107e1461d451cdb2eae7b102bd9ba6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/808900\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Brad Fitzpatrick \u003cbradfitz@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "99c3b0a8f463fdf9bfde3b2cb50599ee53891eb0",
      "tree": "69d968d3628784fbab06fd128f2945324b974274",
      "parents": [
        "5a920b1a80900b1da0d73d18b73c193f7b52b901"
      ],
      "author": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Wed Jul 29 02:11:09 2026 +0000"
      },
      "committer": {
        "name": "Brad Fitzpatrick",
        "email": "bradfitz@golang.org",
        "time": "Wed Jul 29 16:30:39 2026 -0700"
      },
      "message": "http2/hpack: build the table lookup maps lazily, only for encoders\n\nThe headerFieldTable byName and byNameValue maps exist to serve\nsearch, which is only reachable from the Encoder. Decoder dynamic\ntables allocated and maintained them anyway, for every entry ever\nadded or evicted, even though nothing ever read from them.\n\nFor servers with many mostly-idle HTTP/2 connections, each pinning a\ndecoder dynamic table for the connection\u0027s lifetime, those maps are a\nmeaningful fraction of per-connection memory: on one proxy instance\nwith ~124k long-poll connections, hpack table maps accounted for\n~230MB of live heap.\n\nBuild the maps lazily on the first search call instead, so decoders\nnever allocate them. Encoder behavior is unchanged: its first\nWriteField builds the maps from the (usually empty) table and\nmaintains them incrementally from then on, as before.\n\nChange-Id: I1db5d23c3ea8202497a559f70cdcd597f14fefa1\nReviewed-on: https://go-review.googlesource.com/c/net/+/807260\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "5a920b1a80900b1da0d73d18b73c193f7b52b901",
      "tree": "c7756bb4f0d828e2fa8c04a88361eafa8b35b7d8",
      "parents": [
        "7fd284277aab94a6bd16c6a50b7604958f7a18a1"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 15 14:02:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Jul 23 13:43:03 2026 -0700"
      },
      "message": "http3: rework registration to allow using a fake network\n\nThis is the x/net half of a paired set of changes which modify\nthe mechanism by which x/net/http3 integrates with net/http.\nThe other half of the change is CL 803380.\n\nx/net/http3 exports two functions via linkname for use by\nnet/http\u0027s tests. These are now:\n\n\tregisterServer(*http.Server, opts any) error\n\tregisterTransport(*http.Transport, opts any) error\n\nThese are now thin wrappers around the interal/http3 registration\nfunctions, with a bit of reflection-based struct copying to permit\npassing in options without exporting the options types.\n\n(The end state is for these functions to be exported and take\nexported options types.)\n\nServer registration no longer uses TLSNextProto.\nInstead, the HTTP/3 server registers itself via net/http.Server.Serve,\nwhich is the same approach used by x/net/http2.\nThis gives us a simpler link between the two packages.\nFor example, net/http can just call a Shutdown method on the HTTP/3 server\nand pass it a Context, rather than the prior complex dance.\n\nThe HTTP/3 server no longer calls net.Listen.\nIt always accepts a net.PacketConn from net/http.\n\nTransportOpts now has a ListenPacket field, in addition to ListenQUIC.\n\nServer and Transport now both accept their *tls.Configs from net/http.\nnet/http is responsible for correctly configuring NextProtos.\nThis makes TLS config construction more consistent overall,\nsince net/http already sets up the HTTP/1 and HTTP/2 configs.\n\nThese changes simplify the registration machinery in some places,\nbut mainly permit us to now pass a fake net.PacketConn from\nnet/http\u0027s tests into the http package.\n\nAs part of this change, the HTTP/3 server\u0027s handler and base context\nare now per-endpoint rather than per-server.\n\nnet/http Servers permit setting a per-net.Listener base context\nfor request handlers. Treating the HTTP/3 base context as per-endpoint\nmaintains the equivalent ability. Making the handler per-endpoint\nisn\u0027t strictly necessary, but is consistent with the context and\nsimplifies the connection between net/http and x/net/http3.\n\nFor golang/go#80480\n\nChange-Id: I10d6e998c11cade33e517d1d2f03a2d86a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801940\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "7fd284277aab94a6bd16c6a50b7604958f7a18a1",
      "tree": "fdf7b0649d5ed8a45a5866f98f6c7fb88b3949f0",
      "parents": [
        "825111d7f2d2ccf50aa8eb63f62da04e2e3c5dc6"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Jul 17 12:07:49 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jul 21 14:46:59 2026 -0700"
      },
      "message": "quic: return an error from Accept after PacketConn reader exits\n\nIf we encounter an error reading from an endpoint\u0027s PacketConn,\nthe reader exits and the endpoint becomes unusable.\n\nReturn an error from Accept, rather than blocking forever.\n\nChange-Id: Ia3c306d37d93c857be05999b9c642f456a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/803300\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "825111d7f2d2ccf50aa8eb63f62da04e2e3c5dc6",
      "tree": "1dc8dacb01cf3c96f7f93d0c481af5e5a5a2105a",
      "parents": [
        "a02ddfa7eacb4cf63a5bea6b23761244a6df69f6"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Thu Jul 16 09:29:10 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jul 21 14:46:56 2026 -0700"
      },
      "message": "quic: avoid busy-loop when keep-alive is blocked by congestion control\n\nWhen a connection\u0027s keep-alive timer expires, we send a PING frame.\nSending an ack-eliciting frame such as a PING clears the idle timer.\nHowever, if the frame could not be sent (due to being blocked by\ncongestion control, for example), the keep-alive timer was not cleared\nresulting in the connection event loop busy-waiting on the timer.\n\nNow, when the keep-alive timer expires we clear it immediately and\nset a flag indicating that we want to send a keep-alive.\n\nMinor related fix: Disable the keep-alive and idle timers when\nentering the closing/draining states. (We never set these timers\nwhen in these states, but we failed to clear them on entry.)\n\nChange-Id: I9f3f2327f2138273b7e10c4185cf9c176a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801882\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "a02ddfa7eacb4cf63a5bea6b23761244a6df69f6",
      "tree": "b5536a80e2da617cfde016fee58bba49096da5c2",
      "parents": [
        "574e5eb9d32de67fb16096316d40bb9c412e4906"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Thu Jul 16 13:18:01 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jul 20 13:04:44 2026 -0700"
      },
      "message": "http/httpproxy: prioritize lowercase proxy environment variables\n\nFor HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables,\nprioritize the lowercase version if both the uppercase and lowercase\nversions are set. While there is not an official standard, prioritizing\nthe lowercase environment variables seem to be what most implementations\nhave converged on. Therefore, we might as well follow.\n\nThis change should be relatively safe. Users will only observe a\nbehavior difference should they be setting both an uppercase and\nlowercase proxy environment variables with different values.\n\nFor golang/go#79656\n\nChange-Id: Ife71d260bcc61c52617a05cf5c3d53fb6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801700\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "574e5eb9d32de67fb16096316d40bb9c412e4906",
      "tree": "c91f5b8dd8932b228910e6d613370a1b51f39fb9",
      "parents": [
        "0da447f3719ea55fe4804c143b468c1f3c2a195e"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 15 14:02:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jul 17 12:53:44 2026 -0700"
      },
      "message": "quic: halt conn goroutines on close when listener exits early\n\nEndpoint.Close could return with conn goroutines still running\nif the endpoint\u0027s PacketConn was closed prior to the last conn\nexiting. (Normally the last conn to exit closes the PacketConn.)\nClean up any stray conns before returning.\n\nChange-Id: I444f7dbb1e7b194c74a1ff8025abb4346a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801881\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "0da447f3719ea55fe4804c143b468c1f3c2a195e",
      "tree": "0e384c88eb1f3d8ef4ac2417bc0788fe4b955d3c",
      "parents": [
        "e7e2eb826435a8a87bdce4722d252732fb5ad42e"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 15 14:02:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jul 17 12:53:40 2026 -0700"
      },
      "message": "quic: permit Config.Clone on a nil Config\n\nThe documentation says this is okay,\nbut the implementation disagreed.\n\nChange-Id: I1f88aa2b9e4f1c05ccad3aac3622586f6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/801880\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "e7e2eb826435a8a87bdce4722d252732fb5ad42e",
      "tree": "59c4a0fa7fd61579669d75057a85b154102dabd5",
      "parents": [
        "6ae817d64941bbcea5838701b6dad7af41047e66"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jul 13 12:19:52 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jul 13 17:11:23 2026 -0700"
      },
      "message": "internal/http3: prevent request body read when 100 status was not sent\n\nMake HTTP/3 pass TestServerExpect100ContinueUnreadBody that was added in\nCL 793160.\n\nAlso add serverRequestReader so the server will always deal with the\nsame req.Body. This makes the code simpler and gets rid of the scattered\nlogic used to coordinate bodyReader and responseWriter.\n\nFor golang/go#70914\n\nChange-Id: Ic94c222f39e83e121012ddcd2579a2b66a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/798321\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "6ae817d64941bbcea5838701b6dad7af41047e66",
      "tree": "7db0055707b17bc8de73cee2e56c6cf035729b90",
      "parents": [
        "a3c1227e666da136a7d1dbc685c4842492d34c36"
      ],
      "author": {
        "name": "ismailshadow",
        "email": "ismailismailgamal52@gmail.com",
        "time": "Mon May 25 16:02:58 2026 +0000"
      },
      "committer": {
        "name": "Sean Liao",
        "email": "sean@liao.dev",
        "time": "Fri Jul 10 10:39:57 2026 -0700"
      },
      "message": "dns/dnsmessage: add boundary check in unpackSVCBResource\n\nCurrently, bodyEnd is calculated using the length parameter from the\nresource header without verifying if it exceeds the physical capacity\nof the msg buffer.\n\nIf a malformed record provides a length that\nexceeds the buffer, it bypasses the first-pass parameter validation\nand causes an out-of-bounds slice during the second-pass copy.\n\nAdding a check against len(msg) aligns this function with the boundary\nenforcement used throughout the rest of the package.\n\nChange-Id: I13f6ca83d1c30eac02286a49c12f8ec543d33e41\nGitHub-Last-Rev: 78c35a160c45f09f2db04d9ec076dfb091a15595\nGitHub-Pull-Request: golang/net#249\nReviewed-on: https://go-review.googlesource.com/c/net/+/781880\nReviewed-by: Sean Liao \u003csean@liao.dev\u003e\nReviewed-by: ISMAIL GAMAL \u003cismailismailgamal52@gmail.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Junyang Shao \u003cshaojunyang@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "a3c1227e666da136a7d1dbc685c4842492d34c36",
      "tree": "0441615c9d9118fd8102ec5799f1ab4b3654aa9e",
      "parents": [
        "b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jul 07 10:59:12 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 17:33:50 2026 -0700"
      },
      "message": "internal/http3: implement server read and write deadlines\n\nThe HTTP/3 server now enforces the net/http server\u0027s ReadHeaderTimeout,\nReadTimeout, and WriteTimeout that is registered via RegisterServer.\n\nAlso clean up logic related to stream closure and reset in the server\nimplementation. Instead, just return the appropriate error and let\ngenericConn.handleStreamError deal with the stream closure and reset.\n\nIdleTimeout is not yet implemented and will be added separately.\n\nFor golang/go#70914\n\nChange-Id: Ie7aaebb673ad6a6386c6cbce273446466a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/798060\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nAuto-Submit: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b8f09f6f062ceb4531b7af4bd17a5c8fe9c4b2b5",
      "tree": "c73b305ee8763f750716c88c122ac5859481df27",
      "parents": [
        "f05f21be5927155a88b371674c298ada54b71cf5"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 11:49:09 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Wed Jul 08 14:02:14 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I7f67042b70ae290dc0ca73793ad35882e395e629\nReviewed-on: https://go-review.googlesource.com/c/net/+/798460\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "f05f21be5927155a88b371674c298ada54b71cf5",
      "tree": "49059e8d40bec08315c0200da01ea46c48da15c8",
      "parents": [
        "0f748cfbba95084c87723e3b7eb7dad9241fc2dd"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 01 16:00:33 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jul 07 15:13:12 2026 -0700"
      },
      "message": "idna: reject all-ASCII xn-- labels on all Go versions\n\nChange generated from x/text with CL 796420 applied.\n\nFor golang/go#78760\n\nChange-Id: Ie6233f98492821f3e42b726488d9a9856a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/796421\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "0f748cfbba95084c87723e3b7eb7dad9241fc2dd",
      "tree": "614d6f25632cc89833af9f10222a5676408ea06f",
      "parents": [
        "0bb961e45132c680e2a0117e1df951538a19da61"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 22 23:02:03 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jul 07 09:41:15 2026 -0700"
      },
      "message": "internal/http3: clean up stream I/O methods usages in tests\n\nIn CL 796400, I/O methods were added to the internal/http3.stream. As a\nfollow-up to that CL, modify our tests to stop calling I/O methods from\ninternal/quic.stream.\n\nAlso add internal/http.stream.WriteByte method for symmetry.\n\nFor golang/go#70914\n\nChange-Id: I2036589d89ceac97f80e3f34a29cea786a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/797280\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "0bb961e45132c680e2a0117e1df951538a19da61",
      "tree": "969605e15003715411ada1851f5a4f0e761b16d0",
      "parents": [
        "0ca694d2a5adcce7f36d4d65e5f8d72390d94051"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 16 15:06:43 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jul 06 12:36:43 2026 -0700"
      },
      "message": "internal/http3: add net/http.ResponseController support\n\nServer now implements SetReadDeadline, SetWriteDeadline,\nEnableFullDuplex, and FlushError (with Hijack being left unsupported\nintentionally as HTTP/3 does not support hijacking).\n\nFor golang/go#70914\n\nChange-Id: I0821d6eec4e534e01a33f1ea923ae59d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/792000\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "0ca694d2a5adcce7f36d4d65e5f8d72390d94051",
      "tree": "e1555c6891ddf320299ae9f0dbc163b3fb3e860a",
      "parents": [
        "bd5f1dcf71cf0d6d2424021d0a04f191396a46a7"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 30 14:53:11 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jul 01 09:03:05 2026 -0700"
      },
      "message": "webdav: document Dir\u0027s lack of defense against filesystem modification\n\nChange-Id: Id2d5f4053497445e006ca30229a1925e6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/795860\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "bd5f1dcf71cf0d6d2424021d0a04f191396a46a7",
      "tree": "af7cd40063344ad7daa8c44250a16b5eb451dfe2",
      "parents": [
        "488ff63197ffddbcef2d01107f8a89906a4f28d1"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Jun 29 21:35:12 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 30 13:52:41 2026 -0700"
      },
      "message": "http2: initialize Transport on NewClientConn\n\nAdd a missing init call in the NewClientConn path.\n\nMissing init calls are hard to write a test for, since the\nTransport test infrastructure causes the Transport to be\ninitialized before the test begins. So instead, make it harder\nto forget the call: init now returns the net/http *Transport,\nso code which uses it needs to call init to get it.\n\nFixes golang/go#80198\n\nChange-Id: Ib6465b863bb0be3cd3d02d9c1bb349526a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/795600\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "488ff63197ffddbcef2d01107f8a89906a4f28d1",
      "tree": "d4e29ca7eec0428d58b5f916f667ef30665c4178",
      "parents": [
        "93d1f25be95961edfdf488b9398e53fb9f05f193"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 30 11:28:31 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 30 13:52:17 2026 -0700"
      },
      "message": "bpf: add security considerations to package docs\n\nChange-Id: I9d9bd9b66f6b5290ecd356fcefb1659d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/795780\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "93d1f25be95961edfdf488b9398e53fb9f05f193",
      "tree": "40f49fcdd7ce9d2f70d538a892a7f965715506b1",
      "parents": [
        "5a3baee349e65853c34b4377bebe7676a64dbc87"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 23 16:30:13 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Wed Jun 24 07:54:26 2026 -0700"
      },
      "message": "xsrftoken: avoid token collisions\n\nAdjust token sanitization to avoid collisions.\nFor example, previously (\"u:\", \"a\") and (\"u\", \":a\")\nboth produced the (pre-hashing) token \"u:::a:\u003ctimestamp\u003e\".\n\nFixes golang/go#80125\n\nChange-Id: Ia932b762096abaa32bb790999c8e21e56a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/793540\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "5a3baee349e65853c34b4377bebe7676a64dbc87",
      "tree": "ffc164e3d443965def31ad0c325c70b6bdf75c6f",
      "parents": [
        "9e7fdbfadb32b0cc7524100014c5cf9b6adc7729"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 23 12:56:25 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 23 13:10:39 2026 -0700"
      },
      "message": "internal/http3: prevent panic in QPACK decoder due to overflow\n\nChange-Id: I4b887a2b888aac80203badbc4d0dc1356a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/793363\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "9e7fdbfadb32b0cc7524100014c5cf9b6adc7729",
      "tree": "2eea34906f7b8d8d422566c0de2cc34f5ca7f5ad",
      "parents": [
        "b686e5f3573e5f55120d664fc283ed7e80c1af3c"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Jun 09 12:47:33 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 09 09:58:42 2026 -0700"
      },
      "message": "internal/http3: fix wrong argument being given when validating header value\n\nChange-Id: I04eb0db74bfe677829d06623ec3ab77d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/788880\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nAuto-Submit: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "b686e5f3573e5f55120d664fc283ed7e80c1af3c",
      "tree": "ca3d63f99223608fb40588825f0f80adff64fa61",
      "parents": [
        "8a348850ed6818306667722af2b42a6fc63473e0"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 29 14:50:25 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 08 14:06:00 2026 -0700"
      },
      "message": "internal/http3: add gzip support to transport\n\nHTTP/3 now behaves similarly to HTTP/1 and HTTP/2 in terms of gzip\nsupport. Implementation of gzip reader and its pool are taken from\nnet/http.\n\nFor golang/go#70914\n\nChange-Id: I829c0b9472e4c698b0f1a4012d8659b46a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/785120\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "8a348850ed6818306667722af2b42a6fc63473e0",
      "tree": "7b7d7c93354ed029c1726b30c5949dd5fcd4dba7",
      "parents": [
        "72eaf98743302f6e0ad10883163dfc46dc8e8183"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 08 09:05:07 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 08 10:06:21 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I6d18e0698f4d3c81f5fd3d5ab8a9200b23602199\nReviewed-on: https://go-review.googlesource.com/c/net/+/788223\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\n"
    },
    {
      "commit": "72eaf98743302f6e0ad10883163dfc46dc8e8183",
      "tree": "5e7304920c91d2af82c97df51e50c50c2e70d28b",
      "parents": [
        "82e7868a02167540748b74780b0bf825985256f7"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 02 15:06:17 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon Jun 08 09:07:53 2026 -0700"
      },
      "message": "dns/dnsmessage: correctly validate SVCB record parameter order\n\nFix a bug which caused us to not properly validate the order\nof parameters in SVCB/HTTPS records.\n\nFixes golang/go#79796\n\nChange-Id: I9d3c43bde06f3d25786a5b89e45613e76a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/786346\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "82e7868a02167540748b74780b0bf825985256f7",
      "tree": "4f29cd03570d2cbb4f6f34ab3d36c503118268d2",
      "parents": [
        "b64f1fa4c615965246e5b9e5c9d614916fa8967d"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Jun 02 14:48:48 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri Jun 05 11:05:24 2026 -0700"
      },
      "message": "dns/dnsmessage: avoid panic when parsing SVCB record with truncated data\n\nThanks to Mundur (https://github.com/M0nd0R) for reporting this issue.\n\nFixes golang/go#79795\nFixes CVE-2026-46600\n\nChange-Id: Ie32a9dae6789eb98c816bc7508feba686a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/786345\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "b64f1fa4c615965246e5b9e5c9d614916fa8967d",
      "tree": "ccf6064868537a2a947d523e3c5625d9397a77d6",
      "parents": [
        "2707ee21efea70599446dd35979b1d1aedf44ada"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 01 17:12:20 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu Jun 04 11:26:45 2026 -0700"
      },
      "message": "internal/http3: add server support for \"Trailer:\" magic prefix\n\nSimilar to our HTTP/1 and HTTP/2 implementations, allow HTTP/3 server\nhandler to send trailer headers that have not been declared prior to\nwriting response body by using the \"Trailer:\" magic prefix.\n\nTo support this, also modify transport to accept all trailers, even\nthose that have not been declared. This is consistent with the behavior\nof our HTTP/1 and HTTP/2 implementations. Note the following,\nunfortunately somewhat convoluted, behavior:\n\n1. Transport will never send undeclared trailers.\n2. Transport will accept undeclared trailers.\n3. Server will never accept undeclared trailers.\n4. Server will never send undeclared trailers, unless they use the\n   \"Trailer:\" magic prefix.\n\nFor golang/go#70914\n\nChange-Id: Ifa5e026eb6ce68af9a8364845e4f2def6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/785860\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Viacheslav Danilin \u003cviacheslavdanilin@gmail.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "2707ee21efea70599446dd35979b1d1aedf44ada",
      "tree": "5ab1a92771765ec09baa2a57b74d0e360ddc5d52",
      "parents": [
        "31358cc259a764905194e3d6c597375b0ff366c1"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue May 26 15:31:29 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu Jun 04 09:49:23 2026 -0700"
      },
      "message": "internal/http3: implement HTTP/3 clientConn methods\n\nImplement Err, Reserve, Release, Available, and InFlight methods in our\nHTTP/3 implementation. This allows clientConn to implement the\ngenericClientConn interface in net/http.\n\nGiven that we have no good understanding yet of when one might want to\ncreate multiple HTTP/3 connections to the same server, Available will\nalways return MaxInt.\n\nFor golang/go#70914\n\nChange-Id: Ib1316b33195b6f5d584c5a371d60cddf6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/784500\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "31358cc259a764905194e3d6c597375b0ff366c1",
      "tree": "775c8ae1b26943970b073ecccb48c0bd96929304",
      "parents": [
        "8ecbaa95fea823c19fa74c5c3b53e0bccd473828"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 29 13:43:51 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Jun 03 15:04:37 2026 -0700"
      },
      "message": "internal/http3: snapshot response headers at WriteHeader time\n\nHTTP/3 currently buffers small body writes. As a result, if a server\nhandler modifies its headers after WriteHeader has been called, the\nmodified headers will be sent by the server as part of its response.\nThis behavior is generally unexpected and inconsistent with our HTTP/2\nimplementation.\n\nTherefore, change HTTP/3 server to snapshot the headers at WriteHeader\ntime, to ensure that buffering responses will not result in different\nheaders being sent.\n\nFor golang/go#70914\n\nChange-Id: Ie1ed44f2cfc3d60ac28d8bb64118bd846a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/784960\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "8ecbaa95fea823c19fa74c5c3b53e0bccd473828",
      "tree": "1db32a7a2992048e7bb2a627f54cb09a8bc11822",
      "parents": [
        "8ae811abe5c2daa55c68d51a101af1c5751a4d55"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 05 13:50:37 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:06:09 2026 -0700"
      },
      "message": "html: don\u0027t adjust xml:base\n\nChange-Id: Ifac8571bedbb153b7e97ce2d2af47b5bc05b381c\nReviewed-on: https://go-review.googlesource.com/c/net/+/781893\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "8ae811abe5c2daa55c68d51a101af1c5751a4d55",
      "tree": "69cad35a6cd11e02501e4767342a3cebd4442e79",
      "parents": [
        "3e9891da1ce72c7c271efec3cf516b42377a37b8"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 05 13:33:58 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:06:05 2026 -0700"
      },
      "message": "html: properly handle end script tag in fragment mode\n\nChange-Id: I10af60ce9aa6ffc2f2bc330026f9e4bc5cb30bb7\nReviewed-on: https://go-review.googlesource.com/c/net/+/781892\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "3e9891da1ce72c7c271efec3cf516b42377a37b8",
      "tree": "6482ce1582f2b521c88e0a235066ec14efcc3d08",
      "parents": [
        "5a0480ccee4f718e5963b6721d27a5f1c14326dc"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 05 12:58:24 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:14 2026 -0700"
      },
      "message": "html: add selectedcontent tests to skip list\n\nChange-Id: I052e06968da12795accaec7e8bb99f1ec2013ff5\nReviewed-on: https://go-review.googlesource.com/c/net/+/781891\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "5a0480ccee4f718e5963b6721d27a5f1c14326dc",
      "tree": "2936924cec8d947f624e949f31a67e6aff9367cf",
      "parents": [
        "86561db28616030146d65e44420acd03613a7fa2"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 21:01:29 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:11 2026 -0700"
      },
      "message": "html: update parser to match spec select behavior\n\nChange-Id: Idfbe3805907b6274cae07ec70f10108ab07696cd\nReviewed-on: https://go-review.googlesource.com/c/net/+/781890\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\n"
    },
    {
      "commit": "86561db28616030146d65e44420acd03613a7fa2",
      "tree": "4d38860a88ee957af0e0b1bc22d4a56d869b36f5",
      "parents": [
        "93a0bd91d9850a867c717fa435370044cbf97c5a"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 17:20:55 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:08 2026 -0700"
      },
      "message": "html: properly handle fragment foreign content breakout\n\nChange-Id: I8a97547c58fc74cb3c551a4a63f300a7254108f7\nReviewed-on: https://go-review.googlesource.com/c/net/+/781889\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "93a0bd91d9850a867c717fa435370044cbf97c5a",
      "tree": "523ceab6a24aa931633a882a4fad32ebafe8e078",
      "parents": [
        "42abb857022cb79baacfa240bcf48588aa80bbee"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 17:20:29 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 13:02:05 2026 -0700"
      },
      "message": "html: switch from the webkit tests to html5lib-tests\n\nChange-Id: I40b16419113892de7be38903a0dbfab68ba8f68b\nReviewed-on: https://go-review.googlesource.com/c/net/+/781888\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "42abb857022cb79baacfa240bcf48588aa80bbee",
      "tree": "a2387d142ec4055cdd7dab6ad31488fb29fca649",
      "parents": [
        "9d1bca88f13459b48f25f8c3226621c55fcd56f7"
      ],
      "author": {
        "name": "Davanum Srinivas",
        "email": "davanum@gmail.com",
        "time": "Mon Jun 01 20:44:10 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue Jun 02 08:30:38 2026 -0700"
      },
      "message": "http2: enable HTTP/2 in wrap configureTransport\n\nThe go1.27 wrap implementation of ConfigureTransport is a no-op, and\nConfigureTransports only registers the protocol with net/http; neither\nenables HTTP/2 on the transport or initializes TLSClientConfig. The\npre-wrapping transport.go did both.\n\nAs a result, callers that enable HTTP/2 on a transport with a custom\nTLSClientConfig or dialer (where net/http does not enable HTTP/2\nautomatically) send requests over HTTP/1 to an HTTP/2 server. Without\n\"h2\" in NextProtos this is a silent downgrade to HTTP/1.1; with it, the\nconnection negotiates h2 at the TLS layer but is read by the HTTP/1\ntransport, failing with \"net/http: HTTP/1.x transport connection broken:\nmalformed HTTP response\".\n\nThis is the client-side counterpart of the server-side fix in CL 782940.\nconfigureTransport now delegates to configureTransports, which ensures a\nnon-nil TLSClientConfig and enables net/http\u0027s native HTTP/2 via\nTransport.Protocols.\n\nTestConfigureTransport is gated to the legacy build\n(!(go1.27 \u0026\u0026 !http2legacy)) and does not compile into the wrapper build,\nwhich is why this regressed silently. The new transport_configure_test.go\nis untagged and exercises both ConfigureTransport and ConfigureTransports\nunder the legacy and wrap builds.\n\nFixes golang/go#79778\n\nChange-Id: Ibc27bced8679fcb3baa7953bad12315da07535fb\nReviewed-on: https://go-review.googlesource.com/c/net/+/785900\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "9d1bca88f13459b48f25f8c3226621c55fcd56f7",
      "tree": "72abc5834a34e1e6b21f7a80db7d0f1a0f2ad841",
      "parents": [
        "ed393feb7de2574616a34134c213042fa6be899f"
      ],
      "author": {
        "name": "cuishuang",
        "email": "imcusg@gmail.com",
        "time": "Sat May 30 23:52:06 2026 +0800"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:36 2026 -0700"
      },
      "message": "all: fix some comments to improve readability\n\nChange-Id: I8aa8f216b60abbf3f36ad4112310a2ea221f9d91\nReviewed-on: https://go-review.googlesource.com/c/net/+/785340\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Mark Freeman \u003cmarkfreeman@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "ed393feb7de2574616a34134c213042fa6be899f",
      "tree": "0de9db9a9aa6c988bb6f9b0f86a55ef1ea1c94e6",
      "parents": [
        "d4238335f2996a6f6d74e63e3083b29043f8703b"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 23 13:16:16 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:33 2026 -0700"
      },
      "message": "html: properly emit comment token when eof in markup declaration open state\n\nIn particular, if we hit a EOF while looking for the \"DOCTYPE\" or\n\"[CDATA[\", properly emit a comment token with the fragment, rather than\nemitting an empty comment token.\n\nChange-Id: I749a88b5a894f8c8c38d9ebc6bb78fc7f7626a71\nReviewed-on: https://go-review.googlesource.com/c/net/+/782300\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "d4238335f2996a6f6d74e63e3083b29043f8703b",
      "tree": "052b00038ab21c4684a74ce819300cbd1310b2be",
      "parents": [
        "7c3abf5d0c5aadd4cb49beb18d4f8965e33fec1d"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Fri May 22 13:30:43 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:30 2026 -0700"
      },
      "message": "html: properly handle unicode attribute dup detection\n\nWhen checking if an attribute is a duplicate, only lowercase ASCII\ncharacters, ignoring unicode.\n\nChange-Id: I62646c41fc47c674dec274737fa1198c8b63816d\nReviewed-on: https://go-review.googlesource.com/c/net/+/782260\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "7c3abf5d0c5aadd4cb49beb18d4f8965e33fec1d",
      "tree": "a78171401be0ae815ef5e47837b95e6bcfc8780e",
      "parents": [
        "2d3cf22512d4f0200c7c3696ab75fdf410c929a0"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 14:30:08 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:26 2026 -0700"
      },
      "message": "html: support named entities shorter than their encoding\n\nChange-Id: Ica0522cd4213cf38023c10695e314f929c021f48\nReviewed-on: https://go-review.googlesource.com/c/net/+/781886\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n"
    },
    {
      "commit": "2d3cf22512d4f0200c7c3696ab75fdf410c929a0",
      "tree": "fbc137641443be2380eda75fcbc7a1c7f218c808",
      "parents": [
        "3f77b0808bcbbe3f091c9684dd63df86a1088d20"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 13:31:37 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:22 2026 -0700"
      },
      "message": "html: properly parse zero numeric entity\n\nChange-Id: Icb5db53ce9dc28d367f6652e91ab4966a7b38ac3\nReviewed-on: https://go-review.googlesource.com/c/net/+/781885\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "3f77b0808bcbbe3f091c9684dd63df86a1088d20",
      "tree": "51e6143279dabac98a7cf92db0a9203938d99b18",
      "parents": [
        "1e933f51e39b3fea170c6defa9f3c12011c1473e"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 13:28:05 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:19 2026 -0700"
      },
      "message": "html: avoid overflow when decoding numeric entities\n\nChange-Id: I18a7817a16ecb45c343565e94141e94bd50242d6\nReviewed-on: https://go-review.googlesource.com/c/net/+/781884\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "1e933f51e39b3fea170c6defa9f3c12011c1473e",
      "tree": "fc95924a6a9dcf617abb4e4ef29be7fd045b9e3c",
      "parents": [
        "088b2ce7682db4b4a9f6e0b1b2513f25256cbcb3"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 12:24:22 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:16 2026 -0700"
      },
      "message": "html: replace nul bytes in tag names and attributes\n\nChange-Id: I34063225c9179844b1220e798e18ce6a20b097e0\nReviewed-on: https://go-review.googlesource.com/c/net/+/781883\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "088b2ce7682db4b4a9f6e0b1b2513f25256cbcb3",
      "tree": "58acfe912b74a6fa7e64b36223e606b7c9a2a6e8",
      "parents": [
        "65e84c3ad8f4f4a13be20b3a030c7c278960fe04"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 11:59:09 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:12 2026 -0700"
      },
      "message": "html: properly handle bogus comment \u003c!\u003e\n\nChange-Id: I9358382378cbbcfbd055d7fa2341280ff991b74c\nReviewed-on: https://go-review.googlesource.com/c/net/+/781882\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "65e84c3ad8f4f4a13be20b3a030c7c278960fe04",
      "tree": "bfc0dc36902f40c74a07c15bc361c835135a5a1d",
      "parents": [
        "008e5e7789e6ebd2d598cf87289d0cf6fea55ddc"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Sat May 02 11:25:51 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Mon Jun 01 13:33:09 2026 -0700"
      },
      "message": "html: add html5lib-tests tokenizer test suite\n\nDisable a bunch of failing tests for now so we can fix them in follow\nups.\n\nChange-Id: I8bbce9d8f138382a7dc0eb22dfed61d6ae08a79c\nReviewed-on: https://go-review.googlesource.com/c/net/+/781881\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Roland Shoemaker \u003croland@golang.org\u003e\n"
    },
    {
      "commit": "008e5e7789e6ebd2d598cf87289d0cf6fea55ddc",
      "tree": "c7871bb1146ad937804469645d94b45c2134a05f",
      "parents": [
        "db078759488c2fa21999184c21a2abdb1ab6b423"
      ],
      "author": {
        "name": "Davanum Srinivas",
        "email": "davanum@gmail.com",
        "time": "Mon May 25 18:26:00 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Mon Jun 01 11:48:02 2026 -0700"
      },
      "message": "http2: register h2 ALPN on s.TLSConfig in wrap configureServer\n\nThe go1.27 wrap implementation of configureServer did not initialize\ns.TLSConfig or append the h2 and http/1.1 ALPN protocols to its\nNextProtos, so callers that combine http2.ConfigureServer with their\nown TLS listener (e.g. tls.Listen or httptest.Server.StartTLS) ended\nup negotiating http/1.1 only, and HTTP/2 clients failed the TLS\nhandshake with \"tls: no application protocol\".\n\nMirror the corresponding block from the pre-wrapping server.go, using\nslices.Contains since strSliceContains lives in transport.go which is\ngated to the legacy build tag.\n\nFixes golang/go#79642\n\nChange-Id: Ib172422b88950d7c692bade24e40f75c4f143cd2\nReviewed-on: https://go-review.googlesource.com/c/net/+/782940\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "db078759488c2fa21999184c21a2abdb1ab6b423",
      "tree": "87e47a67664714a7d0013f5d2417a08d188320c3",
      "parents": [
        "657eb1317b5dd33038d683297c6be9cae05fa97d"
      ],
      "author": {
        "name": "Neal Patel",
        "email": "neal@golang.org",
        "time": "Fri May 29 11:33:56 2026 -0400"
      },
      "committer": {
        "name": "Neal Patel",
        "email": "neal@golang.org",
        "time": "Fri May 29 09:46:14 2026 -0700"
      },
      "message": "all: bump x/crypto to 0.52.0\n\nFixes golang/go#79738\n\nChange-Id: I8a8381d8a2c1b81f66b46e0de5be86f5a11c2ecc\nReviewed-on: https://go-review.googlesource.com/c/net/+/784880\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "657eb1317b5dd33038d683297c6be9cae05fa97d",
      "tree": "43b136a996cba42fff92d2686dda9b9edada2ae8",
      "parents": [
        "7770ec48d03fec35e378665337b4faca93c38423"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 22 16:49:03 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Tue May 26 08:43:43 2026 -0700"
      },
      "message": "internal/http3: document possible issue in Darwin when using dual-stack binding\n\nFor golang/go#78737\n\nChange-Id: I1112c6ec5fcfe22513b6d80c792806056a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/782080\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "7770ec48d03fec35e378665337b4faca93c38423",
      "tree": "04db8f41cb27ab54739ee6cba10bfe7bc5fee105",
      "parents": [
        "4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:13:58 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:45:50 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I1905a384363c0893821050162b74ba3c6faed7ba\nReviewed-on: https://go-review.googlesource.com/c/net/+/781740\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nTryBot-Bypass: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "4ece7b612ad44ad6c4d5e0d5d4df9c18cc211905",
      "tree": "a60cd8c5a0594a0f4acd0c185c7c8a66be6da015",
      "parents": [
        "08be507abce89191d78cd49da60f4501fc910472"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 11:47:15 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:12:51 2026 -0700"
      },
      "message": "html: escape greater-than symbol in doctype identifiers\n\nDuring parsing, we unescape character references. When rendering, we\nre-escape certain characters in certain scenarios in order to avoid\ntoken content causing unexpected parser behavior.\n\nWe appear to have not taken this into account when rendering DOCTYPE\ntokens, allowing \"\u003e\" in PUBLIC/SYSTEM identifier strings, which trigger\na abrupt-doctype-system-identifier parse error which immediately emits\nthe current DOCTYPE token and then continues parsing in the data state.\n\nThis may cause bypass in HTML santizers which use the html package for\nparsing.\n\nThanks to ensy for reporting this issue.\n\nFixes CVE-2026-25681\n\nChange-Id: I1d5be92129d17bfbf0917148db2672d57c224a18\nReviewed-on: https://go-review.googlesource.com/c/net/+/781703\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nTryBot-Bypass: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "08be507abce89191d78cd49da60f4501fc910472",
      "tree": "e8f042fe54cba17bd6ca10fe7d58a98d600b7ec7",
      "parents": [
        "a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Tue May 12 15:36:39 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:12:48 2026 -0700"
      },
      "message": "html: improve Noah\u0027s Ark clause performance\n\nInstead of iterating over each element in the stack, and checking each\nattribute against each other attribute in a ~cubic fashion, sort the\nattributes and just use slices.Equal.\n\nThanks to IPC Labs for reporting this issue.\n\nFixes CVE-2026-25680\n\nChange-Id: Iec3513ba0b5da4f28f1359d24846401b9ab76ee3\nReviewed-on: https://go-review.googlesource.com/c/net/+/781702\nTryBot-Bypass: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n"
    },
    {
      "commit": "a8fb2fe4f7378f816302b9f2f7b8290ce512e5dd",
      "tree": "7a0a06a8985b19847ffe56a3c05bd8dcc8a9f0e1",
      "parents": [
        "0dc5b7a5f81d7155ade6d5e9db35992998679932"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Mon May 04 14:01:10 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:12:45 2026 -0700"
      },
      "message": "html: properly render fostered elements in foreign content\n\nWhen we foster elements under another parent, there are complicated\nrules about which namespace may apply. This in particular affects\nchildTextNodesAreLiteral, which checks if we should be emitting raw\ntext, or escaped text.\n\nIn childTextNodesAreLiteral, check if there is an ancestor which has a\ndifferent namespace. If one is found, check if it\u0027s an HTML integration\npoint. If not, treat the node as if it were in its parents namespace, if\nso, treat it as HTML.\n\nThanks to Tristan Madani for reporting this issue.\n\nFixes CVE-2026-42502\n\nChange-Id: I0ae1780dae335e5f719d7f176cefa83670cfea3d\nReviewed-on: https://go-review.googlesource.com/c/net/+/781701\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nTryBot-Bypass: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\n"
    },
    {
      "commit": "0dc5b7a5f81d7155ade6d5e9db35992998679932",
      "tree": "873562403e0aa570e2b6649f4fc093f4b7cddea6",
      "parents": [
        "a452f3cc17168a60bc3f439a3ae0fcffc32eca0e"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Fri May 08 11:58:29 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:12:42 2026 -0700"
      },
      "message": "html: properly check namespace in \"in body\" any other end tag\n\nWhen processing \"any other end tag\" in the \"in body\" insertion mode,\nwhen searching for a matching start tag, properly check that said tag is\nin the HTML namespace.\n\nThanks to ensy for reporting this issue.\n\nFixes CVE-2026-42506\n\nChange-Id: Ia05867b3d8f8df69f7e9410a85d126fe0b092875\nReviewed-on: https://go-review.googlesource.com/c/net/+/781700\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nTryBot-Bypass: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\n"
    },
    {
      "commit": "a452f3cc17168a60bc3f439a3ae0fcffc32eca0e",
      "tree": "e38467e133478793a05b2417fc09baefacff2cca",
      "parents": [
        "f8651996b24ba47d89dd9eb97fd47758e6d1886f"
      ],
      "author": {
        "name": "Roland Shoemaker",
        "email": "roland@golang.org",
        "time": "Fri May 08 12:09:06 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu May 21 18:12:39 2026 -0700"
      },
      "message": "html: ignore duplicate attributes during tokenization\n\nDuring tokenization ignore attributes with names we\u0027ve already seen,\nper WHATWG 13.2.5.33. This removes a parser misalignment that could be\nleveraged to confuse sanitizers.\n\nThanks to ensy for reporting this issue.\n\nFixes CVE-2026-27136\n\nChange-Id: Ib0a3edb8dbea35c431f74f8b0bbe6229625d7e1f\nReviewed-on: https://go-review.googlesource.com/c/net/+/781685\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nTryBot-Bypass: Roland Shoemaker \u003croland@golang.org\u003e\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "f8651996b24ba47d89dd9eb97fd47758e6d1886f",
      "tree": "d7bc880b95b4ee96ec8989baedfda23373f33444",
      "parents": [
        "210ed3cb901cb549818aefa04b71dadaf149d05d"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 15 15:46:41 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 15 13:27:32 2026 -0700"
      },
      "message": "quic: fix appendMaxDataFrame erroneously accumulating sentLimit\n\nsentLimit value should be of the last MAX_DATA sent to the peer.\nHowever, we are currently incorrectly incrementing its value rather than\nupdating it.\n\nChange-Id: Id73ce651158e7c4f031e8a2e5099e9d36a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/778380\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "210ed3cb901cb549818aefa04b71dadaf149d05d",
      "tree": "33537326ab8778f88bb74080f55a3d178115f76d",
      "parents": [
        "ad8140e0aa2ec41b37ea478b4525a423bcc21af9"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Thu May 14 09:35:26 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 15 09:34:55 2026 -0700"
      },
      "message": "quic: establish a \"happened-before\" relationship between stream write and read\n\nThis ensures that our race detector will not get tripped off in tests\nwhere we do something like the following:\n\n1. Client writes to a shared variable.\n2. Client sends a request to a server.\n3. Server handler reads the shared variable.\n\nWe are technically over-synchronizing right now by always using the\naddress of quicSync when calling runtime.RaceAcquire and\nruntime.RaceReleaseMerge. However, that is fine for now since this\nmostly matters just for testing, and creating a mapping of stream ID to\naddressess are rather unclean.\n\nFor golang/go#78737\n\nChange-Id: Id65964ad3aa0b2e998e8faf11bfda3c76a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/777940\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "ad8140e0aa2ec41b37ea478b4525a423bcc21af9",
      "tree": "1ef834d6adb54bdf342f0a46b4f00403cf555fe7",
      "parents": [
        "23ee2efe81a3ff183b4eca46c42f749af7efca45"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 08 01:00:52 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Fri May 08 19:22:15 2026 -0700"
      },
      "message": "quic: fix buffer slicing when handling overlapping stream data\n\nWhen processing a STREAM frame that overlaps with already received data,\nour slicing calculation is wrong. As a result, upon receiving duplicate\ndata, such as when packets are retransmitted, we end up writing the same\ndata multiple times rather than deduplicating them. This seems to have\nresulted in spurious FINAL_SIZE_ERROR in our tests.\n\nFor golang/go#78737\n\nChange-Id: I0c6d34d7f7f376310dad43983cbdf32b6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/776080\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "23ee2efe81a3ff183b4eca46c42f749af7efca45",
      "tree": "1efab4271a7ba50c37ae8d1d8dd67585a452518d",
      "parents": [
        "b138e06246cb323f2f380c2b7f7dd91f581dd56b"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri May 08 14:15:14 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri May 08 16:29:35 2026 -0700"
      },
      "message": "http2: avoid API changes when built with go1.27\n\nThe wrapping implementation accidentally dropped some symbols.\nPreserve them.\n\nMove errors into common locations:\n  - ErrNoCachedConn\n  - ErrPushLimitReached\n  - ErrRecursivePush\n  - GoAwayError\n\nMove one constant into a common location:\n  - TrailerPrefix\n\nPreserve methods of FrameWriteRequest as no-ops.\nThese are not a user-serviceable part and there is no way\nfor users to construct FrameWriteRequests.\n  - FrameWriteRequest.Consume\n  - FrameWriteRequest.DataSize\n  - FrameWriteRequest.StreamID\n  - FrameWriteRequest.String\n\nPreserve functions which create write schedulers,\nreturning a no-op implementation of WriteScheduler:\n- NewPriorityWriteScheduler\n- NewRandomWriteScheduler\n- PriorityWriteSchedulerConfig\n\nFor golang/go#78508\n\nChange-Id: I327603137cf69d93bb405d9a95e038886a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/776180\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@golang.org\u003e\n"
    },
    {
      "commit": "b138e06246cb323f2f380c2b7f7dd91f581dd56b",
      "tree": "58e242148eed5253dd037b2fae1d785212cb7f79",
      "parents": [
        "689f70a42abd350f3a1aaa70b0d13eb9543d927a"
      ],
      "author": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri May 08 11:49:52 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Fri May 08 13:02:48 2026 -0700"
      },
      "message": "go.mod: update golang.org/x dependencies\n\nUpdate golang.org/x dependencies to their latest tagged versions.\n\nChange-Id: I221634578c7606d4a4d9c8c27cf748f375af8c61\nReviewed-on: https://go-review.googlesource.com/c/net/+/775721\nAuto-Submit: Gopher Robot \u003cgobot@golang.org\u003e\nReviewed-by: Dmitri Shuralyov \u003cdmitshur@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Cherry Mui \u003ccherryyz@google.com\u003e\n"
    },
    {
      "commit": "689f70a42abd350f3a1aaa70b0d13eb9543d927a",
      "tree": "e972d1e48d36aa12c7b7d95bf4216ca3d30a2158",
      "parents": [
        "208f306b2f0fd008b388bee2c2644be279778e94"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed May 06 18:25:43 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu May 07 10:25:00 2026 -0700"
      },
      "message": "quic: fix wrong final size being used for RESET_STREAM frame\n\nPreviously, the final size in a RESET_STREAM frame was calculated as\nmin(s.outwin, s.out.end). This could result in a final size value that\nis larger than the amount of data actually sent, such as when data is\nbuffered but blocked due to connection-level flow control.\n\nTherefore, change RESET_STREAM frame to use s.outmaxsent as the final\nsize, which tracks the actual offset of data that has been sent.\n\nThis might perhaps explain the rare flakes that we have been observing,\nwhere HTTP/3 tests would hang indefinitely.\n\nFor golang/go#78737\n\nChange-Id: I31466712e9fe75d5fcb4461fb6905f4a6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/774943\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "208f306b2f0fd008b388bee2c2644be279778e94",
      "tree": "64d3844d43d1565bfbd695ada99ba41ab94d3d15",
      "parents": [
        "49810da71b9026da9e0d028a6ad8c7730c52d9c4"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Wed May 06 10:32:35 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Thu May 07 09:30:39 2026 -0700"
      },
      "message": "http3: increase handshake timeout\n\nIncrease the QUIC handshake timeout for std tests to avoid flakes on\nslow builders.\n\nFor golang/go#78737\n\nChange-Id: I8d7ccfb3c8b55e0b0b4ab0b7b22dcd0a6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/774800\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "49810da71b9026da9e0d028a6ad8c7730c52d9c4",
      "tree": "d3259a8cf1ea4b55c70e473dff3fecfcc1b45882",
      "parents": [
        "5e11a5ab891c117eda83b4304d60dd13286c1c76"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue Apr 28 15:43:28 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Tue May 05 16:03:31 2026 -0700"
      },
      "message": "http2: enable net/http wrapping when go \u003e\u003d 1.27\n\nWhen building with Go 1.27 or newer, use an HTTP/2\nclient and server which are implemented in terms of net/http.\n\nThe original source of truth for the Go HTTP/2 implementation\nwas the x/net/http2 package. A copy of this package was included\nin the standard library.\n\nIn Go 1.27, the source of truth of the HTTP/2 implementation\nhas moved entirely into the standard library. There are no\nsupported features of the HTTP/2 implementation which require\nimporting x/net/http2, and most users should just use net/http\ndirectly.\n\nWe still support existing code which imports x/net/http2.\nTo avoid maintaining two divergent HTTP/2 implementations,\nx/net/http2 (when used with a recent enough version of Go)\nnow just wraps net/http.\n\nFor now, users may revert to the the pre-Go 1.27 implementation\nby setting the build tag \"http2legacy\":\n\n  go build -tags\u003dhttp2legacy ...\n\nFor golang/go#78508\n\nChange-Id: I6efeddc4f3bcba9388c19cbcd1e9b8a56a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/774440\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "5e11a5ab891c117eda83b4304d60dd13286c1c76",
      "tree": "63552c630ebed0d010e8ae912198dce9dbf05a63",
      "parents": [
        "8c63081cd380ea768db5651941614b73472160ff"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Mon May 04 15:06:30 2026 -0400"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Tue May 05 11:14:49 2026 -0700"
      },
      "message": "quic: fix data race in streamForFrame\n\nIn streamForFrame, localStreamLimits.opened is read without\nsynchronization, resulting in a race condition. Therefore, synchronize\nthe access by using the associated gate, like in\nlocalStreamLimits.setMax.\n\nFor golang/go#79104\nFor golang/go#78737\n\nChange-Id: I623e4a5f621b1eebfdaaee0f01f78b966a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/773940\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nAuto-Submit: Nicholas Husin \u003cnsh@golang.org\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "8c63081cd380ea768db5651941614b73472160ff",
      "tree": "43e4e85c54066bdc426e594ba779839c1ad2bf28",
      "parents": [
        "fc7b466ca49cb204039630533ece4fc557eb35cd"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri May 01 11:29:16 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon May 04 15:24:01 2026 -0700"
      },
      "message": "http2: use empty Transport rather than DefaultTransport in http2wrap\n\nWhen initializing an http2.Transport with no associated http.Transport\n(that is, when the user doesn\u0027t call ConfigureTransport or\nConfigureTransports to connect the net/http and x/net/http2\nTransports together), we create an http.Transport.\n\nCreate a blank Transport with default configuration parameters\nrather than cloning http.DefaultTransport.\n\n- There\u0027s no guarantee that DefaultTransport is a *http.Transport,\n  since the user could have replaced it.\n\n- The historical behavior of http2.Transport is to use its own\n  default configuration, not inherit the configuration from\n  DefaultTransport.\n\nFor #78508\n\nChange-Id: Iac7b5e722405824e0a35543c9cec6ec56a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/773180\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "fc7b466ca49cb204039630533ece4fc557eb35cd",
      "tree": "cbc783046b3ea41022bb7945308423b8d340b819",
      "parents": [
        "15c2cb1875fd727313dc4de909b3ee149422fbe2"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Apr 03 15:30:56 2026 -0700"
      },
      "committer": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Mon May 04 10:35:36 2026 -0700"
      },
      "message": "http2: add http2wrap test\n\nAdd a test which reruns the package tests with -tags\u003dhttp2wrap,\nwhen the Go version supports it.\n\nFor #78508\n\nChange-Id: I4ebf7e676de18f5d33e480e67997727d6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/771221\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    },
    {
      "commit": "15c2cb1875fd727313dc4de909b3ee149422fbe2",
      "tree": "ba48dc37e3defe1589c8fb1bca9b68e3778a55aa",
      "parents": [
        "64651885c2f2d745d77af2d7af2edbf568c179af"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Apr 03 15:30:56 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Apr 30 16:24:29 2026 -0700"
      },
      "message": "http2: avoid overflowing 32-bit int when http2wrap enabled\n\nFixes builds on 32-bit platforms.\n\nFor #78508\n\nChange-Id: I57c93cf016629ced2a5404dc1cf533786a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/772601\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\n"
    },
    {
      "commit": "64651885c2f2d745d77af2d7af2edbf568c179af",
      "tree": "f1df36c051d31e273479b063974866d38d164d43",
      "parents": [
        "72f419a894cb0597dd5b6bcf119086bf2af41231"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Apr 03 15:30:56 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Apr 30 16:16:23 2026 -0700"
      },
      "message": "http2: add wrapped Server\n\nImplement Server in terms of net/http.\n\nFor #78508\n\nChange-Id: Iad2b592b8c4f32d66126eb52d8881e8e6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/771220\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\n"
    },
    {
      "commit": "72f419a894cb0597dd5b6bcf119086bf2af41231",
      "tree": "e849bdfb265f094e356e4445bf41c3cdf4c9dc36",
      "parents": [
        "4c78867080b655fc02d8371f3123d57d08d12dd6"
      ],
      "author": {
        "name": "Damien Neil",
        "email": "dneil@google.com",
        "time": "Fri Apr 03 15:30:56 2026 -0700"
      },
      "committer": {
        "name": "Gopher Robot",
        "email": "gobot@golang.org",
        "time": "Thu Apr 30 10:47:44 2026 -0700"
      },
      "message": "http2: add wrapped ClientConn\n\nImplement ClientConn in terms of net/http,\nincluding support for user-provided Transport.ConnPools.\n\nFor #78508\n\nChange-Id: I5245620594538ab9befad888823ed40c6a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/771142\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nReviewed-by: Nicholas Husin \u003cnsh@golang.org\u003e\nAuto-Submit: Damien Neil \u003cdneil@google.com\u003e\n"
    },
    {
      "commit": "4c78867080b655fc02d8371f3123d57d08d12dd6",
      "tree": "53ae5ca660cb2ea1832529c401ce1b614d78fa19",
      "parents": [
        "8512dfe67a8607c8de785bd3cd3d5e3fecac7c08"
      ],
      "author": {
        "name": "Nicholas S. Husin",
        "email": "nsh@golang.org",
        "time": "Tue Apr 28 02:08:13 2026 -0400"
      },
      "committer": {
        "name": "Nicholas Husin",
        "email": "nsh@golang.org",
        "time": "Wed Apr 29 11:14:28 2026 -0700"
      },
      "message": "internal/http3: reject response headers with invalid characters in RoundTrip\n\nSimilar to our server implementation, RoundTrip should reject response\nheaders which contains invalid characters (e.g. uppercase characters and\ncontrol characters) when doing QPACK decoding.\n\nFor golang/go#70914\n\nChange-Id: Ifa4065b709a30e72ce8a3fa4c64110b36a6a6964\nReviewed-on: https://go-review.googlesource.com/c/net/+/771423\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\nReviewed-by: Nicholas Husin \u003chusin@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n"
    }
  ],
  "next": "8512dfe67a8607c8de785bd3cd3d5e3fecac7c08"
}