)]}'
{
  "commit": "367ce9e9df3a5c6a35d013826e306c82da64bd6a",
  "tree": "72d755bedbdade730f7ed6c444cad611ca331391",
  "parents": [
    "ac40b0f06c159afb5bfca4d1860f8b4b60dbc160"
  ],
  "author": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Tue Oct 20 13:38:53 2026 -0700"
  },
  "committer": {
    "name": "Damien Neil",
    "email": "dneil@google.com",
    "time": "Tue Oct 20 15:05:37 2026 -0700"
  },
  "message": "internal/export/idna: avoid excessive work in Punycode encoding\n\nPunycode encoding (conversion to ASCII) is an inherently quadratic\nalgorithm. Avoid excessive CPU consumption when processing long,\npotentially-untrusted inputs.\n\nDecoding applied a cap of 1024 runes to inputs, but encoding had no limit.\nReduce the limit to 256 runes (still many more than can appear in any\nvalid DNS label) and apply it to both encoding and decoding.\n\nAlso avoid repeated UTF-8 decoding in encode by copying the input string\nto a []rune buffer.\n\nAlso avoid allocations in encode and decode by using a stack-allocated\n[64]rune buffer for most operations (including all operations on valid\nDNS names) and only allocating when overflowing the buffer.\n\nThanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.\n\nFixes CVE-2026-97044\nFor golang/go#82374\n\nChange-Id: Ib5027a79fe76cdd9a382d0dff715ec856a6a6964\nReviewed-on: https://go-review.googlesource.com/c/text/+/851765\nReviewed-by: Neal Patel \u003cneal@golang.org\u003e\nReviewed-by: Neal Patel \u003cnealpatel@google.com\u003e\nLUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c075e8e7182c92f43a36c9d69d2d360ebff70415",
      "old_mode": 33188,
      "old_path": "internal/export/idna/idna_test.go",
      "new_id": "1646ae7ec5388c3e5e60e3e33ec4e0697cf1097b",
      "new_mode": 33188,
      "new_path": "internal/export/idna/idna_test.go"
    },
    {
      "type": "modify",
      "old_id": "5f541e1e796721c17a0e34bcc9c714054a7e1cf3",
      "old_mode": 33188,
      "old_path": "internal/export/idna/punycode.go",
      "new_id": "885f5f9f81bb279c800421bc06984ecbdb8c82ed",
      "new_mode": 33188,
      "new_path": "internal/export/idna/punycode.go"
    },
    {
      "type": "modify",
      "old_id": "5cf0c968aaa1d245fc22825f6167b0fc1a3b6699",
      "old_mode": 33188,
      "old_path": "internal/export/idna/punycode_test.go",
      "new_id": "647c538ea90256be94913a6b45efeadfae7834ff",
      "new_mode": 33188,
      "new_path": "internal/export/idna/punycode_test.go"
    }
  ]
}