You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
TODO: <ahref="https://go.dev/issue/62459">https://go.dev/issue/62459</a>: make default minimum version for servers TLS 1.2
372
-
</p>
373
-
374
-
<p><!-- https://go.dev/issue/63413 -->
375
-
TODO: <ahref="https://go.dev/issue/63413">https://go.dev/issue/63413</a>: disable RSA key exchange cipher suites by default
376
-
</p>
377
-
378
-
<p><!-- CL 514997 -->
379
-
TODO: <ahref="https://go.dev/cl/514997">https://go.dev/cl/514997</a>: crypto/tls: change SendSessionTicket to take an options struct; modified api/go1.21.txt
380
-
</p>
381
-
382
-
<p><!-- CL 541516 -->
383
-
TODO: <ahref="https://go.dev/cl/541516">https://go.dev/cl/541516</a>: crypto/tls: change default minimum version to 1.2
454
+
<p><!-- https://go.dev/issue/43922, CL 544155 -->
455
+
<ahref="/pkg/crypto/tls#ConnectionState.ExportKeyingMaterial"><code>ConnectionState.ExportKeyingMaterial</code></a> will now
456
+
return an error unless TLS 1.3 is in use, or the <code>extended_master_secret</code> extension is supported by both the server and
457
+
client. <code>crypto/tls</code> has supported this extension since Go 1.20. This can be disabled with the
458
+
<code>tlsunsafeekm=1</code> GODEBUG setting.
384
459
</p>
385
460
386
-
<p><!-- CL 541517 -->
387
-
TODO: <ahref="https://go.dev/cl/541517">https://go.dev/cl/541517</a>: crypto/tls: remove RSA KEX ciphers from the default list
461
+
<p><!-- https://go.dev/issue/62459, CL 541516 -->
462
+
By default, the minimum version offered by <code>crypto/tls</code> servers is now TLS 1.2 if not specified with
463
+
<ahref="/pkg/crypto/tls#Config.MinimumVersion"><code>config.MinimumVersion</code></a>, matching the behavior of <code>crypto/tls</code>
464
+
clients. This change can be reverted with the <code>tls10server=1</code> GODEBUG setting.
388
465
</p>
389
466
390
-
<p><!-- CL 544155 -->
391
-
TODO: <ahref="https://go.dev/cl/544155">https://go.dev/cl/544155</a>: crypto/tls: disable ExportKeyingMaterial without EMS
467
+
<p><!-- https://go.dev/issue/63413, CL 541517 -->
468
+
By default, cipher suites without ECDHE support are no longer offered by either clients or servers during pre-TLS 1.3
469
+
handshakes. This change can be reverted with the <code>tlsrsakex=1</code> GODEBUG setting.
TODO: <ahref="https://go.dev/issue/57178">https://go.dev/issue/57178</a>: support code-constrained roots
400
-
</p>
401
-
402
-
<p><!-- https://go.dev/issue/58922 -->
403
-
TODO: <ahref="https://go.dev/issue/58922">https://go.dev/issue/58922</a>: add android user trusted CA folder as a possible source for certificate retrieval
477
+
The new <ahref="/pkg/crypto/x509#CertPool.AddCertWithConstraint"><code>CertPool.AddCertWithConstraint</code></a>
478
+
method can be used to add customized constraints to root certificates to be applied during chain building.
404
479
</p>
405
480
406
-
<p><!-- https://go.dev/issue/60665 -->
407
-
TODO: <ahref="https://go.dev/issue/60665">https://go.dev/issue/60665</a>: introduce new robust OID type & use it for certificate policies
481
+
<p><!-- https://go.dev/issue/58922, CL 519315-->
482
+
On Android, root certificates will now be loaded from <code>/data/misc/keychain/certs-added</code> as well as <code>/system/etc/security/cacerts</code>.
A new type, <ahref="/pkg/crypto/x509#OID"><code>OID</code></a>, supports ASN.1 Object Identifiers with individual
487
+
components larger than 31 bits. A new field which uses this type, <ahref="/pkg/crypto/x509#Certificate.Policies"><code>Policies</code></a>,
488
+
is added to the <code>Certificate</code> struct, and is now populated during parsing. Any OIDs which cannot be represented
489
+
using a <ahref="/pkg/encoding/asn1#ObjectIdentifier"><code>asn1.ObjectIdentifier</code></a> will appear in <code>Policies</code>,
490
+
but not in the old <code>PolicyIdentifiers</code> field.
413
491
414
-
<p><!-- CL 520535 -->
415
-
TODO: <ahref="https://go.dev/cl/520535">https://go.dev/cl/520535</a>: crypto/x509: add new OID type and use it in Certificate; modified api/next/60665.txt
492
+
When calling <ahref="/pkg/crypto/x509#CreateCertificate"><code>CreateCertificate</code></a>, the <code>Policies</code> field is ignored, and
493
+
policies are taken from the <code>PolicyIdentifiers</code> field. Using the <code>x509usepolicies=1</code> GODEBUG setting inverts this,
494
+
populating certificate policies from the <code>Policies</code> field, and ignoring the <code>PolicyIdentifiers</code> field. We may change the
495
+
default value of <code>x509usepolicies</code> in Go 1.23, making <code>Policies</code> the default field for marshaling.
416
496
</p>
417
497
</dd>
418
498
</dl><!-- crypto/x509 -->
@@ -592,14 +672,13 @@ <h3 id="minor_library_changes">Minor changes to the library</h3>
TODO: <ahref="https://go.dev/issue/62418">https://go.dev/issue/62418</a>: enable setting level on default log.Logger
596
-
</p>
597
-
598
-
<p><!-- CL 525096 -->
599
-
TODO: <ahref="https://go.dev/cl/525096">https://go.dev/cl/525096</a>: log/slog: add LogLoggerLevel to enable setting level on the default logger; modified api/next/62418.txt
675
+
The new <ahref="/pkg/log/slog#SetLogLoggerLevel"><code>SetLogLoggerLevel</code></a> function
676
+
controls the level for the bridge between the `slog` and `log` packages. It sets the minimum level
677
+
for calls to the top-level `slog` logging functions, and it sets the level for calls to `log.Logger`
TODO: <ahref="https://go.dev/issue/61758">https://go.dev/issue/61758</a>: support sub-tests
888
-
</p>
889
-
890
-
<p><!-- CL 516076 -->
891
-
TODO: <ahref="https://go.dev/cl/516076">https://go.dev/cl/516076</a>: testing/slogtest: add Run to run cases as subtests; modified api/next/61758.txt
962
+
The new <ahref="/pkg/testing/slogtest#Run"><code>Run</code></a> function uses sub-tests to run test cases,
963
+
providing finer-grained control.
892
964
</p>
893
965
</dd>
894
966
</dl><!-- testing/slogtest -->
@@ -924,7 +996,7 @@ <h3 id="loong64">Loong64</h3>
924
996
The <code>loong64</code> port now supports passing function arguments and results using registers.
925
997
</p>
926
998
<p><!-- CL 481315,537615,480878 -->
927
-
The <code>linux/loong64</code> port now supports the memory sanitizer, new-style linker relocations, and the <code>plugin</code> build mode.
999
+
The <code>linux/loong64</code> port now supports the address sanitizer, memory sanitizer, new-style linker relocations, and the <code>plugin</code> build mode.
0 commit comments