Merge branch 'golang:master' into master

Author: kumarlokesh

api/next/43936.txt

@@ -0,0 +1,4 @@
+pkg testing, method (*B) Attr(string, string) #43936
+pkg testing, method (*F) Attr(string, string) #43936
+pkg testing, method (*T) Attr(string, string) #43936
+pkg testing, type TB interface, Attr(string, string) #43936

api/next/63185.txt

@@ -0,0 +1,9 @@
+pkg runtime/trace, func NewFlightRecorder(FlightRecorderConfig) *FlightRecorder #63185
+pkg runtime/trace, method (*FlightRecorder) Enabled() bool #63185
+pkg runtime/trace, method (*FlightRecorder) Start() error #63185
+pkg runtime/trace, method (*FlightRecorder) Stop() #63185
+pkg runtime/trace, method (*FlightRecorder) WriteTo(io.Writer) (int64, error) #63185
+pkg runtime/trace, type FlightRecorder struct #63185
+pkg runtime/trace, type FlightRecorderConfig struct #63185
+pkg runtime/trace, type FlightRecorderConfig struct, MaxBytes uint64 #63185
+pkg runtime/trace, type FlightRecorderConfig struct, MinAge time.Duration #63185

api/next/63796.txt

@@ -1 +1 @@
-pkg sync, method (*WaitGroup) Go(func()) #63769
+pkg sync, method (*WaitGroup) Go(func()) #63796

api/next/63963.txt

@@ -0,0 +1,4 @@
+pkg crypto/ecdsa, func ParseRawPrivateKey(elliptic.Curve, []uint8) (*PrivateKey, error) #63963
+pkg crypto/ecdsa, func ParseUncompressedPublicKey(elliptic.Curve, []uint8) (*PublicKey, error) #63963
+pkg crypto/ecdsa, method (*PrivateKey) Bytes() ([]uint8, error) #63963
+pkg crypto/ecdsa, method (*PublicKey) Bytes() ([]uint8, error) #63963

api/next/66365.txt

@@ -0,0 +1 @@
+pkg log/slog, func GroupAttrs(string, ...Attr) Attr #66365

api/next/67002.txt

@@ -3,6 +3,8 @@ pkg os, method (*Root) Chown(string, int, int) error #67002
 pkg os, method (*Root) Chtimes(string, time.Time, time.Time) error #67002
 pkg os, method (*Root) Lchown(string, int, int) error #67002
 pkg os, method (*Root) Link(string, string) error #67002
+pkg os, method (*Root) MkdirAll(string, fs.FileMode) error #67002
 pkg os, method (*Root) Readlink(string) (string, error) #67002
+pkg os, method (*Root) RemoveAll(string) error #67002
 pkg os, method (*Root) Rename(string, string) error #67002
 pkg os, method (*Root) Symlink(string, string) error #67002

api/next/69518.txt

@@ -0,0 +1,5 @@
+pkg hash, type XOF interface { BlockSize, Read, Reset, Write } #69518
+pkg hash, type XOF interface, BlockSize() int #69518
+pkg hash, type XOF interface, Read([]uint8) (int, error) #69518
+pkg hash, type XOF interface, Reset() #69518
+pkg hash, type XOF interface, Write([]uint8) (int, error) #69518

api/next/69521.txt

@@ -0,0 +1,9 @@
+pkg crypto/sha3, method (*SHA3) Clone() (hash.Cloner, error) #69521
+pkg hash, type Cloner interface { BlockSize, Clone, Reset, Size, Sum, Write } #69521
+pkg hash, type Cloner interface, BlockSize() int #69521
+pkg hash, type Cloner interface, Clone() (Cloner, error) #69521
+pkg hash, type Cloner interface, Reset() #69521
+pkg hash, type Cloner interface, Size() int #69521
+pkg hash, type Cloner interface, Sum([]uint8) []uint8 #69521
+pkg hash, type Cloner interface, Write([]uint8) (int, error) #69521
+pkg hash/maphash, method (*Hash) Clone() (hash.Cloner, error) #69521

api/next/71920.txt

@@ -0,0 +1 @@
+pkg crypto/tls, type Config struct, GetEncryptedClientHelloKeys func(*ClientHelloInfo) ([]EncryptedClientHelloKey, error) #71920

api/next/73126.txt

@@ -0,0 +1,2 @@
+pkg os, method (*Root) ReadFile(string) ([]uint8, error) #73126
+pkg os, method (*Root) WriteFile(string, []uint8, fs.FileMode) error #73126

api/next/73193.txt

@@ -0,0 +1 @@
+pkg runtime, func SetDefaultGOMAXPROCS() #73193

api/next/73626.txt

@@ -0,0 +1,7 @@
+pkg net/http, func NewCrossOriginProtection() *CrossOriginProtection #73626
+pkg net/http, method (*CrossOriginProtection) AddInsecureBypassPattern(string) #73626
+pkg net/http, method (*CrossOriginProtection) AddTrustedOrigin(string) error #73626
+pkg net/http, method (*CrossOriginProtection) Check(*Request) error #73626
+pkg net/http, method (*CrossOriginProtection) Handler(Handler) Handler #73626
+pkg net/http, method (*CrossOriginProtection) SetDenyHandler(Handler) #73626
+pkg net/http, type CrossOriginProtection struct #73626

doc/godebug.md

@@ -169,6 +169,23 @@ Go command will follow symlinks to regular files embedding files.
 The default value `embedfollowsymlinks=0` does not allow following
 symlinks. `embedfollowsymlinks=1` will allow following symlinks.
 
+Go 1.25 added a new `containermaxprocs` setting that controls whether the Go
+runtime will consider cgroup CPU limits when setting the default GOMAXPROCS.
+The default value `containermaxprocs=1` will use cgroup limits in addition to
+the total logical CPU count and CPU affinity. `containermaxprocs=0` will
+disable consideration of cgroup limits. This setting only affects Linux.
+
+Go 1.25 added a new `updatemaxprocs` setting that controls whether the Go
+runtime will periodically update GOMAXPROCS for new CPU affinity or cgroup
+limits. The default value `updatemaxprocs=1` will enable periodic updates.
+`updatemaxprocs=0` will disable periodic updates.
+
+Go 1.25 disabled SHA-1 signature algorithms in TLS 1.2 according to RFC 9155.
+The default can be reverted using the `tlssha1=1` setting.
+
+Go 1.25 switched to SHA-256 to fill in missing SubjectKeyId in
+crypto/x509.CreateCertificate. The setting `x509sha256skid=0` reverts to SHA-1.
+
 Go 1.25 corrected the semantics of contention reports for runtime-internal locks,
 and so removed the [`runtimecontentionstacks` setting](/pkg/runtime#hdr-Environment_Variable).
 

doc/next/4-runtime.md

@@ -17,6 +17,31 @@ This program will now print:
 
     panic: PANIC [recovered, repanicked]
 
+<!-- go.dev/issue/73193 -->
+
+The default behavior of the `GOMAXPROCS` has changed. In prior versions of Go,
+`GOMAXPROCS` defaults to the number of logical CPUs available at startup
+([runtime.NumCPU]). Go 1.25 introduces two changes:
+
+1. On Linux, the runtime considers the CPU bandwidth limit of the cgroup
+   containing the process, if any. If the CPU bandwidth limit is lower than the
+   number of logical CPUs available, `GOMAXPROCS` will default to the lower
+   limit. In container runtime systems like Kubernetes, cgroup CPU bandwidth
+   limits generally correspond to the "CPU limit" option. The Go runtime does
+   not consider the "CPU requests" option.
+
+2. On all OSes, the runtime periodically updates `GOMAXPROCS` if the number
+   of logical CPUs available or the cgroup CPU bandwidth limit change.
+
+Both of these behaviors are automatically disabled if `GOMAXPROCS` is set
+manually via the `GOMAXPROCS` environment variable or a call to
+[runtime.GOMAXPROCS]. They can also be disabled explicitly with the [GODEBUG
+settings](/doc/godebug) `containermaxprocs=0` and `updatemaxprocs=0`,
+respectively.
+
+In order to support reading updated cgroup limits, the runtime will keep cached
+file descriptors for the cgroup files for the duration of the process lifetime.
+
 <!-- go.dev/issue/71546 -->
 
 On Linux systems with kernel support for anonymous VMA names

doc/next/5-toolchain.md

@@ -38,6 +38,18 @@ successfully in Go 1.25. If this change is affecting your code, the solution is
 the non-nil error check earlier in your code, preferably immediately after
 the error-generating statement.
 
+<!-- CLs 653856, 657937, 663795, 664299 -->
+
+The compiler can now allocate the backing store for slices on the
+stack in more situations, which improves performance. This change has
+the potential to amplify the effects of incorrect
+[unsafe.Pointer](/pkg/unsafe#Pointer) usage, see for example [issue
+73199](/issue/73199). In order to track down these problems, the
+[bisect tool](https://pkg.go.dev/golang.org/x/tools/cmd/bisect) can be
+used to find the allocation causing trouble using the
+`-compile=variablemake` flag. All such new stack allocations can also
+be turned off using `-gcflags=all=-d=variablemakehash=n`.
+
 ## Assembler {#assembler}
 
 ## Linker {#linker}

doc/next/6-stdlib/1-synctest.md

@@ -1,5 +1,6 @@
 ### New testing/synctest package
 
+<!-- go.dev/issue/67434, go.dev/issue/73567 -->
 The new [testing/synctest](/pkg/testing/synctest) package
 provides support for testing concurrent code.
 

doc/next/6-stdlib/99-minor/crypto/ecdsa/63963.md

@@ -0,0 +1,3 @@
+The new [ParseRawPrivateKey], [ParseUncompressedPublicKey], [PrivateKey.Bytes],
+and [PublicKey.Bytes] functions and methods implement low-level encodings,
+replacing the need to use crypto/elliptic or math/big functions and methods.

doc/next/6-stdlib/99-minor/crypto/sha3/69521.md

@@ -0,0 +1 @@
+The new [SHA3.Clone] method implements [hash.Cloner](/pkg/hash#Cloner).

doc/next/6-stdlib/99-minor/crypto/tls/71920.md

@@ -0,0 +1,3 @@
+The new [Config.GetEncryptedClientHelloKeys] callback can be used to set the
+[EncryptedClientHelloKey]s for a server to use when a client sends an Encrypted
+Client Hello extension.

doc/next/6-stdlib/99-minor/crypto/tls/72883.md

@@ -0,0 +1,3 @@
+SHA-1 signature algorithms are now disallowed in TLS 1.2 handshakes, per
+[RFC 9155](https://www.rfc-editor.org/rfc/rfc9155.html).
+They can be re-enabled with the `tlssha1=1` GODEBUG option.

doc/next/6-stdlib/99-minor/crypto/tls/version_pref.md

@@ -0,0 +1 @@
+TLS servers now prefer the highest supported protocol version, even if it isn't the client's most preferred protocol version.

doc/next/6-stdlib/99-minor/crypto/x509/71746.md

@@ -0,0 +1,2 @@
+[CreateCertificate] now uses truncated SHA-256 to populate the `SubjectKeyId` if
+it is missing. The GODEBUG setting `x509sha256skid=0` reverts to SHA-1.

doc/next/6-stdlib/99-minor/hash/69518.md

@@ -0,0 +1,3 @@
+The new [XOF](/pkg/hash#XOF) interface can be implemented by "extendable output
+functions", which are hash functions with arbitrary or unlimited output length
+such as [SHAKE](https://pkg.go.dev/crypto/sha3#SHAKE).

doc/next/6-stdlib/99-minor/hash/69521.md

@@ -0,0 +1,2 @@
+Hashes implementing the new [Cloner] interface can return a copy of their state.
+All standard library [Hash] implementations now implement [Cloner].

doc/next/6-stdlib/99-minor/hash/maphash/69521.md

@@ -0,0 +1 @@
+The new [Hash.Clone] method implements [hash.Cloner](/pkg/hash#Cloner).

doc/next/6-stdlib/99-minor/log/slog/66365.md

@@ -0,0 +1 @@
+[GroupAttrs] creates a group [Attr] from a slice of [Attr] values.

doc/next/6-stdlib/99-minor/net/http/73626.md

@@ -0,0 +1,7 @@
+The new [CrossOriginProtection] implements protections against [Cross-Site
+Request Forgery (CSRF)][] by rejecting non-safe cross-origin browser requests.
+It uses [modern browser Fetch metadata][Sec-Fetch-Site], doesn't require tokens
+or cookies, and supports origin-based and pattern-based bypasses.
+
+[Sec-Fetch-Site]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site
+[Cross-Site Request Forgery (CSRF)]: https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF

doc/next/6-stdlib/99-minor/os/67002.md

@@ -5,6 +5,10 @@ The [os.Root] type supports the following additional methods:
   * [os.Root.Chtimes]
   * [os.Root.Lchown]
   * [os.Root.Link]
+  * [os.Root.MkdirAll]
+  * [os.Root.ReadFile]
   * [os.Root.Readlink]
+  * [os.Root.RemoveAll]
   * [os.Root.Rename]
   * [os.Root.Symlink]
+  * [os.Root.WriteFile]

doc/next/6-stdlib/99-minor/os/73126.md

@@ -0,0 +1 @@
+<!-- go.dev/issue/73126 is documented as part of 67002 -->

doc/next/6-stdlib/99-minor/runtime/73193.md

@@ -0,0 +1,5 @@
+The new [SetDefaultGOMAXPROCS] function sets `GOMAXPROCS` to the runtime
+default value, as if the `GOMAXPROCS` environment variable is not set. This is
+useful for enabling the [new `GOMAXPROCS` default](#runtime) if it has been
+disabled by the `GOMAXPROCS` environment variable or a prior call to
+[GOMAXPROCS].

doc/next/6-stdlib/99-minor/runtime/trace/63185.md

@@ -0,0 +1,2 @@
+<!-- go.dev/issue/63185 -->
+TODO The flight recorder has been added to the runtime/trace package.

doc/next/6-stdlib/99-minor/sync/63769.md renamed to doc/next/6-stdlib/99-minor/sync/63796.md

@@ -0,0 +1,10 @@
+The new methods [T.Attr], [B.Attr], and [F.Attr] emit an
+attribute to the test log. An attribute is an arbitrary
+key and value associated with a test.
+
+For example, in a test named `TestAttr`,
+`t.Attr("key", "value")` emits:
+
+```
+=== ATTR  TestAttr key value
+```