v1.25.1-1

Microsoft build of Go v1.25.1-1

What's Changed

• [release-branch.go1.25] More specific GoPublishReleaseStudio to avoid dev branches (#1830) by @dagood in #1832
• Add 1.25 note about "-fips" tag removal by @dagood in #1837
• [release-branch.go1.25] Consolidate signing diag files, use outputParentDirectory (#1835) by @dagood in #1839
• [release-branch.go1.25] Port fixes to use new Windows builder and test 2019 by @dagood in #1846
• [release-branch.go1.25] Implement ms_tls_config_schannel experiment (#1844) by @qmuntal in #1847
• Update submodule to latest release-branch.go1.25 in microsoft/release-branch.go1.25 by @bot-for-go[bot] in #1854

Full Changelog: v1.25.0-1...v1.25.1-1

v1.24.7-1

Microsoft build of Go v1.24.7-1

What's Changed

• [release-branch.go1.24] Attribute patch files to bot: clarify lack of ownership (#1787) by @gdams in #1811
• [release-branch.go1.24] Port infra changes for prod, official, signing by @dagood in #1817
• [release-branch.go1.24] Split validation pipeline for resource trigger (#1825) by @dagood in #1826
• [release-branch.go1.24] More specific GoPublishReleaseStudio to avoid dev branches (#1830) by @dagood in #1831
• [release-branch.go1.24] Consolidate signing diag files, use outputParentDirectory (#1835) by @dagood in #1838
• [release-branch.go1.24] Port fixes to use new Windows builder and test 2019 by @dagood in #1845
• [release-branch.go1.24] Implement ms_tls_config_schannel experiment (#1844) by @qmuntal in #1848
• Update submodule to latest release-branch.go1.24 in microsoft/release-branch.go1.24 by @bot-for-go[bot] in #1853

Full Changelog: v1.24.6-1...v1.24.7-1

v1.25.0-1

Microsoft build of Go v1.25.0-1

What's Changed

System-provided cryptography enabled by default

The Microsoft build of Go 1.25 enables the systemcrypto experiment by default:

• Linux: Uses OpenSSL (requires cgo)
• Windows: Uses CNG (does not require cgo)

Note

macOS: system-provided crypto backend remains in preview and is not enabled by default.

This aligns with Microsoft's internal security and compliance policies. You may need to take action if your builds rely on Linux without cgo, use distroless containers, or have cross-distro deployment requirements.

To opt out of systemcrypto, set the GOEXPERIMENT environment variable to include nosystemcrypto.

For full documentation, see the Microsoft build of Go FIPS guide.

The -fips variant Docker container images are no longer supported

The change to enable system-provided cryptography by default applies to all Docker container images for the Microsoft build of Go.
The -fips image variants only set the GOEXPERIMENT environment to systemcrypto, so there is no longer any reason to use them.
These variants are no longer produced.

If you use the -fips image variants prior to 1.25, to upgrade to 1.25 you must switch to the standard container image tags by removing the -fips substring from your tag reference.

For more information, see the recommended tags for the Microsoft build of Go.

Telemetry collection enabled

The Microsoft build of Go 1.25 introduces opt-out telemetry collection to help us prioritize features, identify performance bottlenecks, and understand real-world developer workflows. All telemetry is anonymized and handled in accordance with Microsoft's privacy policies.

To disable telemetry, set the MS_GOTOOLCHAIN_TELEMETRY_ENABLED environment variable to be 0.

Full Changelog: https://github.com/microsoft/go/commits/v1.25.0-1

v1.24.6-1

Microsoft build of Go v1.24.6-1

What's Changed

• backport: ci: add workflow to check if vendor patch is clean by @gdams in #1752
• [release-branch.go1.24] Use correct TSA area path by @qmuntal in #1759
• Update submodule to latest release-branch.go1.24 in microsoft/release-branch.go1.24 by @bot-for-go[bot] in #1808

Full Changelog: v1.24.5-1...v1.24.6-1

v1.23.12-1

Microsoft build of Go v1.23.12-1

What's Changed

• Set supported TLS version based on Schannel cipher suites by @qmuntal in #1755
• [release-branch.go1.23] Remove curve prefix from Schannel cipher suite names by @qmuntal in #1757
• [release-branch.go1.23] Use correct TSA area path by @qmuntal in #1760
• Make ms_tls_config_schannel no-op on Windows Server 2012 by @qmuntal in #1768
• [release-branch.go1.23] Update MS_TLS_Config_Schannel comments by @dagood in #1770
• Update submodule to latest release-branch.go1.23 in microsoft/release-branch.go1.23 by @bot-for-go[bot] in #1809

Full Changelog: v1.23.11-1...v1.23.12-1

v1.24.5-1

Microsoft build of Go v1.24.5-1

What's Changed

• Update submodule to latest release-branch.go1.24 in microsoft/release-branch.go1.24 by @bot-for-go in #1729

Full Changelog: v1.24.4-1...v1.24.5-1

v1.23.11-1

Microsoft build of Go v1.23.11-1

What's Changed

• [release-branch.go1.23] Support for excluding OS-disabled cipher suites in TLS handshake by @qmuntal in #1727
• Update submodule to latest release-branch.go1.23 in microsoft/release-branch.go1.23 by @bot-for-go in #1730

Full Changelog: v1.23.10-1...v1.23.11-1

v1.24.4-1

Microsoft build of Go v1.24.4-1

What's Changed

• [microsoft/release-branch.go1.24] Disable innerloop network isolation by @dagood in #1670
• [release-branch.go1.24] Support serializing SymCrypt hash objects by @qmuntal in #1685
  • On Azure Linux 3, all hash algorithms now support the encoding.BinaryMarshaler, encoding.BinaryUnmarshaler, and encoding.BinaryAppender interfaces. This requires the SymCrypt-OpenSSL package version 1.9.0 or higher.
• Update submodule to latest release-branch.go1.24 in microsoft/release-branch.go1.24 by @bot-for-go in #1690

Full Changelog: v1.24.3-1...v1.24.4-1

v1.23.10-1

Microsoft build of Go v1.23.10-1

What's Changed

• [microsoft/release-branch.go1.23] Disable innerloop network isolation by @dagood in #1669
• Update submodule to latest release-branch.go1.23 in microsoft/release-branch.go1.23 by @bot-for-go in #1691

Full Changelog: v1.23.9-1...v1.23.10-1

v1.24.3-1

Microsoft build of Go v1.24.3-1

What's Changed

• Backport TLS13-KDF to 1.24 release branch by @nicholasberlin in #1662
• Update submodule to latest release-branch.go1.24 in microsoft/release-branch.go1.24 by @bot-for-go in #1666

Full Changelog: v1.24.2-2...v1.24.3-1