Merge branch 'golang:master' into master

api/next/61477.txt

@@ -0,0 +1,3 @@
+pkg crypto/hkdf, func Expand[$0 hash.Hash](func() $0, []uint8, string, int) ([]uint8, error) #61477
+pkg crypto/hkdf, func Extract[$0 hash.Hash](func() $0, []uint8, []uint8) ([]uint8, error) #61477
+pkg crypto/hkdf, func Key[$0 hash.Hash](func() $0, []uint8, []uint8, string, int) ([]uint8, error) #61477

api/next/62005.txt

@@ -0,0 +1 @@
+pkg log/slog, var DiscardHandler Handler #62005

api/next/63952.txt

@@ -0,0 +1,33 @@
+pkg debug/elf, const VER_FLG_BASE = 1 #63952
+pkg debug/elf, const VER_FLG_BASE DynamicVersionFlag #63952
+pkg debug/elf, const VER_FLG_INFO = 4 #63952
+pkg debug/elf, const VER_FLG_INFO DynamicVersionFlag #63952
+pkg debug/elf, const VER_FLG_WEAK = 2 #63952
+pkg debug/elf, const VER_FLG_WEAK DynamicVersionFlag #63952
+pkg debug/elf, const VerFlagGlobal = 2 #63952
+pkg debug/elf, const VerFlagGlobal SymbolVersionFlag #63952
+pkg debug/elf, const VerFlagHidden = 4 #63952
+pkg debug/elf, const VerFlagHidden SymbolVersionFlag #63952
+pkg debug/elf, const VerFlagLocal = 1 #63952
+pkg debug/elf, const VerFlagLocal SymbolVersionFlag #63952
+pkg debug/elf, const VerFlagNone = 0 #63952
+pkg debug/elf, const VerFlagNone SymbolVersionFlag #63952
+pkg debug/elf, method (*File) DynamicVersionNeeds() ([]DynamicVersionNeed, error) #63952
+pkg debug/elf, method (*File) DynamicVersions() ([]DynamicVersion, error) #63952
+pkg debug/elf, type DynamicVersion struct #63952
+pkg debug/elf, type DynamicVersion struct, Deps []string #63952
+pkg debug/elf, type DynamicVersion struct, Flags DynamicVersionFlag #63952
+pkg debug/elf, type DynamicVersion struct, Index uint16 #63952
+pkg debug/elf, type DynamicVersion struct, Version uint16 #63952
+pkg debug/elf, type DynamicVersionDep struct #63952
+pkg debug/elf, type DynamicVersionDep struct, Dep string #63952
+pkg debug/elf, type DynamicVersionDep struct, Flags DynamicVersionFlag #63952
+pkg debug/elf, type DynamicVersionDep struct, Other uint16 #63952
+pkg debug/elf, type DynamicVersionFlag uint16 #63952
+pkg debug/elf, type DynamicVersionNeed struct #63952
+pkg debug/elf, type DynamicVersionNeed struct, Name string #63952
+pkg debug/elf, type DynamicVersionNeed struct, Needs []DynamicVersionDep #63952
+pkg debug/elf, type DynamicVersionNeed struct, Version uint16 #63952
+pkg debug/elf, type Symbol struct, VersionFlags SymbolVersionFlag #63952
+pkg debug/elf, type Symbol struct, VersionIndex int16 #63952
+pkg debug/elf, type SymbolVersionFlag uint8 #63952

api/next/66450.txt

@@ -0,0 +1 @@
+pkg crypto/subtle, func WithDataIndependentTiming(func()) #66450

api/next/67002.txt

@@ -0,0 +1,14 @@
+pkg os, func OpenInRoot(string, string) (*File, error) #67002
+pkg os, func OpenRoot(string) (*Root, error) #67002
+pkg os, method (*Root) Close() error #67002
+pkg os, method (*Root) Create(string) (*File, error) #67002
+pkg os, method (*Root) FS() fs.FS #67002
+pkg os, method (*Root) Lstat(string) (fs.FileInfo, error) #67002
+pkg os, method (*Root) Mkdir(string, fs.FileMode) error #67002
+pkg os, method (*Root) Name() string #67002
+pkg os, method (*Root) Open(string) (*File, error) #67002
+pkg os, method (*Root) OpenFile(string, int, fs.FileMode) (*File, error) #67002
+pkg os, method (*Root) OpenRoot(string) (*Root, error) #67002
+pkg os, method (*Root) Remove(string) error #67002
+pkg os, method (*Root) Stat(string) (fs.FileInfo, error) #67002
+pkg os, type Root struct #67002

api/next/67057.txt

@@ -0,0 +1 @@
+pkg crypto/rand, func Text() string #67057

api/next/67535.txt

@@ -0,0 +1,3 @@
+pkg runtime, func AddCleanup[$0 interface{}, $1 interface{}](*$0, func($1), $1) Cleanup #67535
+pkg runtime, method (Cleanup) Stop() #67535
+pkg runtime, type Cleanup struct #67535

api/next/67552.txt

@@ -0,0 +1,3 @@
+pkg weak, func Make[$0 interface{}](*$0) Pointer[$0] #67552
+pkg weak, method (Pointer[$0]) Value() *$0 #67552
+pkg weak, type Pointer[$0 interface{}] struct #67552

api/next/67814.txt

@@ -0,0 +1,8 @@
+pkg net/http, method (*Protocols) SetHTTP1(bool) #67814
+pkg net/http, method (*Protocols) SetHTTP2(bool) #67814
+pkg net/http, method (Protocols) String() string #67814
+pkg net/http, method (Protocols) HTTP1() bool #67814
+pkg net/http, method (Protocols) HTTP2() bool #67814
+pkg net/http, type Protocols struct #67814
+pkg net/http, type Server struct, Protocols *Protocols #67814
+pkg net/http, type Transport struct, Protocols *Protocols #67814

api/next/67816.txt

@@ -0,0 +1,2 @@
+pkg net/http, method (*Protocols) SetUnencryptedHTTP2(bool) #67816
+pkg net/http, method (Protocols) UnencryptedHTTP2() bool #67816

api/next/68484.txt

@@ -0,0 +1,13 @@
+pkg crypto/x509, type Certificate struct, InhibitAnyPolicy int #68484
+pkg crypto/x509, type Certificate struct, InhibitAnyPolicyZero bool #68484
+pkg crypto/x509, type Certificate struct, InhibitPolicyMapping int #68484
+pkg crypto/x509, type Certificate struct, InhibitPolicyMappingZero bool #68484
+pkg crypto/x509, type Certificate struct, PolicyMappings []PolicyMapping #68484
+pkg crypto/x509, type Certificate struct, RequireExplicitPolicy int #68484
+pkg crypto/x509, type Certificate struct, RequireExplicitPolicyZero bool #68484
+pkg crypto/x509, type PolicyMapping struct #68484
+pkg crypto/x509, type PolicyMapping struct, IssuerDomainPolicy OID #68484
+pkg crypto/x509, type PolicyMapping struct, SubjectDomainPolicy OID #68484
+pkg crypto/x509, type VerifyOptions struct, CertificatePolicies []OID #68484
+pkg crypto/x509, const NoValidChains = 10 #68484
+pkg crypto/x509, const NoValidChains InvalidReason #68484

api/next/68500.txt

@@ -0,0 +1,5 @@
+pkg crypto/tls, type Config struct, EncryptedClientHelloKeys []EncryptedClientHelloKey #68500
+pkg crypto/tls, type EncryptedClientHelloKey struct #68500
+pkg crypto/tls, type EncryptedClientHelloKey struct, Config []uint8 #68500
+pkg crypto/tls, type EncryptedClientHelloKey struct, PrivateKey []uint8 #68500
+pkg crypto/tls, type EncryptedClientHelloKey struct, SendAsRetry bool #68500

api/next/69445.txt

@@ -0,0 +1,3 @@
+pkg crypto/cipher, func NewCFBDecrypter //deprecated #69445
+pkg crypto/cipher, func NewCFBEncrypter //deprecated #69445
+pkg crypto/cipher, func NewOFB //deprecated #69445

api/next/69488.txt

@@ -0,0 +1 @@
+pkg crypto/pbkdf2, func Key[$0 hash.Hash](func() $0, string, []uint8, int, int) ([]uint8, error) #69488

api/next/69981.txt

@@ -0,0 +1 @@
+pkg crypto/cipher, func NewGCMWithRandomNonce(Block) (AEAD, error) #69981

api/next/69982.txt

@@ -0,0 +1,31 @@
+pkg crypto/sha3, func New224() *SHA3 #69982
+pkg crypto/sha3, func New256() *SHA3 #69982
+pkg crypto/sha3, func New384() *SHA3 #69982
+pkg crypto/sha3, func New512() *SHA3 #69982
+pkg crypto/sha3, func NewCSHAKE128([]uint8, []uint8) *SHAKE #69982
+pkg crypto/sha3, func NewCSHAKE256([]uint8, []uint8) *SHAKE #69982
+pkg crypto/sha3, func NewSHAKE128() *SHAKE #69982
+pkg crypto/sha3, func NewSHAKE256() *SHAKE #69982
+pkg crypto/sha3, func Sum224([]uint8) [28]uint8 #69982
+pkg crypto/sha3, func Sum256([]uint8) [32]uint8 #69982
+pkg crypto/sha3, func Sum384([]uint8) [48]uint8 #69982
+pkg crypto/sha3, func Sum512([]uint8) [64]uint8 #69982
+pkg crypto/sha3, func SumSHAKE128([]uint8, int) []uint8 #69982
+pkg crypto/sha3, func SumSHAKE256([]uint8, int) []uint8 #69982
+pkg crypto/sha3, method (*SHA3) AppendBinary([]uint8) ([]uint8, error) #69982
+pkg crypto/sha3, method (*SHA3) BlockSize() int #69982
+pkg crypto/sha3, method (*SHA3) MarshalBinary() ([]uint8, error) #69982
+pkg crypto/sha3, method (*SHA3) Reset() #69982
+pkg crypto/sha3, method (*SHA3) Size() int #69982
+pkg crypto/sha3, method (*SHA3) Sum([]uint8) []uint8 #69982
+pkg crypto/sha3, method (*SHA3) UnmarshalBinary([]uint8) error #69982
+pkg crypto/sha3, method (*SHA3) Write([]uint8) (int, error) #69982
+pkg crypto/sha3, method (*SHAKE) AppendBinary([]uint8) ([]uint8, error) #69982
+pkg crypto/sha3, method (*SHAKE) BlockSize() int #69982
+pkg crypto/sha3, method (*SHAKE) MarshalBinary() ([]uint8, error) #69982
+pkg crypto/sha3, method (*SHAKE) Read([]uint8) (int, error) #69982
+pkg crypto/sha3, method (*SHAKE) Reset() #69982
+pkg crypto/sha3, method (*SHAKE) UnmarshalBinary([]uint8) error #69982
+pkg crypto/sha3, method (*SHAKE) Write([]uint8) (int, error) #69982
+pkg crypto/sha3, type SHA3 struct #69982
+pkg crypto/sha3, type SHAKE struct #69982

api/next/69985.txt

@@ -0,0 +1,2 @@
+pkg crypto/tls, const X25519MLKEM768 = 4588 #69985
+pkg crypto/tls, const X25519MLKEM768 CurveID #69985

api/next/70122.txt

@@ -0,0 +1,32 @@
+pkg crypto/mlkem, const CiphertextSize1024 = 1568 #70122
+pkg crypto/mlkem, const CiphertextSize1024 ideal-int #70122
+pkg crypto/mlkem, const CiphertextSize768 = 1088 #70122
+pkg crypto/mlkem, const CiphertextSize768 ideal-int #70122
+pkg crypto/mlkem, const EncapsulationKeySize1024 = 1568 #70122
+pkg crypto/mlkem, const EncapsulationKeySize1024 ideal-int #70122
+pkg crypto/mlkem, const EncapsulationKeySize768 = 1184 #70122
+pkg crypto/mlkem, const EncapsulationKeySize768 ideal-int #70122
+pkg crypto/mlkem, const SeedSize = 64 #70122
+pkg crypto/mlkem, const SeedSize ideal-int #70122
+pkg crypto/mlkem, const SharedKeySize = 32 #70122
+pkg crypto/mlkem, const SharedKeySize ideal-int #70122
+pkg crypto/mlkem, func GenerateKey1024() (*DecapsulationKey1024, error) #70122
+pkg crypto/mlkem, func GenerateKey768() (*DecapsulationKey768, error) #70122
+pkg crypto/mlkem, func NewDecapsulationKey1024([]uint8) (*DecapsulationKey1024, error) #70122
+pkg crypto/mlkem, func NewDecapsulationKey768([]uint8) (*DecapsulationKey768, error) #70122
+pkg crypto/mlkem, func NewEncapsulationKey1024([]uint8) (*EncapsulationKey1024, error) #70122
+pkg crypto/mlkem, func NewEncapsulationKey768([]uint8) (*EncapsulationKey768, error) #70122
+pkg crypto/mlkem, method (*DecapsulationKey1024) Bytes() []uint8 #70122
+pkg crypto/mlkem, method (*DecapsulationKey1024) Decapsulate([]uint8) ([]uint8, error) #70122
+pkg crypto/mlkem, method (*DecapsulationKey1024) EncapsulationKey() *EncapsulationKey1024 #70122
+pkg crypto/mlkem, method (*DecapsulationKey768) Bytes() []uint8 #70122
+pkg crypto/mlkem, method (*DecapsulationKey768) Decapsulate([]uint8) ([]uint8, error) #70122
+pkg crypto/mlkem, method (*DecapsulationKey768) EncapsulationKey() *EncapsulationKey768 #70122
+pkg crypto/mlkem, method (*EncapsulationKey1024) Bytes() []uint8 #70122
+pkg crypto/mlkem, method (*EncapsulationKey1024) Encapsulate() ([]uint8, []uint8) #70122
+pkg crypto/mlkem, method (*EncapsulationKey768) Bytes() []uint8 #70122
+pkg crypto/mlkem, method (*EncapsulationKey768) Encapsulate() ([]uint8, []uint8) #70122
+pkg crypto/mlkem, type DecapsulationKey1024 struct #70122
+pkg crypto/mlkem, type DecapsulationKey768 struct #70122
+pkg crypto/mlkem, type EncapsulationKey1024 struct #70122
+pkg crypto/mlkem, type EncapsulationKey768 struct #70122

api/next/70123.txt

@@ -0,0 +1 @@
+pkg crypto/fips140, func Enabled() bool #70123

doc/go_mem.html

@@ -82,7 +82,7 @@ <h2 id="model">Memory Model</h2>
 <p>
 The following formal definition of Go's memory model closely follows
 the approach presented by Hans-J. Boehm and Sarita V. Adve in
-“<a href="https://www.hpl.hp.com/techreports/2008/HPL-2008-56.pdf">Foundations of the C++ Concurrency Memory Model</a>”,
+“<a href="https://dl.acm.org/doi/10.1145/1375581.1375591">Foundations of the C++ Concurrency Memory Model</a>”,
 published in PLDI 2008.
 The definition of data-race-free programs and the guarantee of sequential consistency
 for race-free programs are equivalent to the ones in that work.

doc/go_spec.html

@@ -1,6 +1,6 @@
 <!--{
 	"Title": "The Go Programming Language Specification",
-	"Subtitle": "Language version go1.23 (Oct 1, 2024)",
+	"Subtitle": "Language version go1.24 (Nov 20, 2024)",
 	"Path": "/ref/spec"
 }-->
 
@@ -3093,7 +3093,7 @@ <h3 id="Method_declarations">Method declarations</h3>
 </p>
 
 <p>
-If the receiver base type is a <a href="#Type_declarations">generic type</a>, the
+If the receiver base type is a <a href="#Type_definitions">generic type</a>, the
 receiver specification must declare corresponding type parameters for the method
 to use. This makes the receiver type parameters available to the method.
 Syntactically, this type parameter declaration looks like an
@@ -3117,6 +3117,22 @@ <h3 id="Method_declarations">Method declarations</h3>
 func (p Pair[First, _]) First() First  { … }  // receiver declares First, corresponds to A in Pair
 </pre>
 
+<p>
+If the receiver type is denoted by (a pointer to) an <a href="#Alias_declarations">alias</a>,
+the alias must not be generic and it must not denote an instantiated generic type, neither
+directly nor indirectly via another alias, and irrespective of pointer indirections.
+</p>
+
+<pre>
+type GPoint[P any] = Point
+type HPoint        = *GPoint[int]
+type IPair         = Pair[int, int]
+
+func (*GPoint[P]) Draw(P)   { … }  // illegal: alias must not be generic
+func (HPoint) Draw(P)       { … }  // illegal: alias must not denote instantiated type GPoint[int]
+func (*IPair) Second() int  { … }  // illegal: alias must not denote instantiated type Pair[int, int]
+</pre>
+
 <h2 id="Expressions">Expressions</h2>
 
 <p>

doc/godebug.md

@@ -34,6 +34,7 @@ For example, if a Go program is running in an environment that contains
 
 then that Go program will disable the use of HTTP/2 by default in both
 the HTTP client and the HTTP server.
+Unrecognized settings in the `GODEBUG` environment variable are ignored.
 It is also possible to set the default `GODEBUG` for a given program
 (discussed below).
 
@@ -165,13 +166,47 @@ The possible values for `multipathtcp` are now:
 - "3": enable MPTCP on dialers only by default
 
 For Go 1.24, it now defaults to multipathtcp="2", thus
-enabled by default on listerners. Using multipathtcp="0" reverts to the
+enabled by default on listeners. Using multipathtcp="0" reverts to the
 pre-Go 1.24 behavior.
 
-Go 1.24 changed [`crypto/rand.Read`](/pkg/crypto/rand/#Read) to crash the
-program on any error. This setting is controlled by the `randcrash` setting.
-For Go 1.24 it defaults to `randcrash=1`.
-Using `randcrash=0` reverts to the pre-Go 1.24 behavior.
+Go 1.24 changed the behavior of `go test -json` to emit build errors as JSON
+instead of text.
+These new JSON events are distinguished by new `Action` values,
+but can still cause problems with CI systems that aren't robust to these events.
+This behavior can be controlled with the `gotestjsonbuildtext` setting.
+Using `gotestjsonbuildtext=1` restores the 1.23 behavior.
+This setting will be removed in a future release, Go 1.28 at the earliest.
+
+Go 1.24 changed [`crypto/rsa`](/pkg/crypto/rsa) to require RSA keys to be at
+least 1024 bits. This behavior can be controlled with the `rsa1024min` setting.
+Using `rsa1024min=0` restores the Go 1.23 behavior.
+
+Go 1.24 introduced a mechanism for enabling platform specific Data Independent
+Timing (DIT) modes in the [`crypto/subtle`](/pkg/crypto/subtle) package. This
+mode can be enabled for an entire program with the `dataindependenttiming` setting.
+For Go 1.24 it defaults to `dataindependenttiming=0`. There is no change in default
+behavior from Go 1.23 when `dataindependenttiming` is unset.
+Using `dataindependenttiming=1` enables the DIT mode for the entire Go program.
+When enabled, DIT will be enabled when calling into C from Go. When enabled,
+calling into Go code from C will enable DIT, and disable it before returning to
+C if it was not enabled when Go code was entered.
+This currently only affects arm64 programs. For all other platforms it is a no-op.
+
+Go 1.24 removed the `x509sha1` setting.  `crypto/x509` no longer supports verifying
+signatures on certificates that use SHA-1 based signature algorithms.
+
+Go 1.24 changes the default value of the [`x509usepolicies`
+setting.](/pkg/crypto/x509/#CreateCertificate) from `0` to `1`. When marshalling
+certificates, policies are now taken from the
+[`Certificate.Policies`](/pkg/crypto/x509/#Certificate.Policies) field rather
+than the
+[`Certificate.PolicyIdentifiers`](/pkg/crypto/x509/#Certificate.PolicyIdentifiers)
+field by default.
+
+Go 1.24 enabled the post-quantum key exchange mechanism
+X25519MLKEM768 by default. The default can be reverted using the
+[`tlsmlkem` setting](/pkg/crypto/tls/#Config.CurvePreferences).
+Go 1.24 also removed X25519Kyber768Draft00 and the Go 1.23 `tlskyber` setting.
 
 ### Go 1.23
 
@@ -365,7 +400,7 @@ There is no plan to remove this setting.
 
 Go 1.18 removed support for SHA1 in most X.509 certificates,
 controlled by the [`x509sha1` setting](/pkg/crypto/x509#InsecureAlgorithmError).
-This setting will be removed in a future release, Go 1.22 at the earliest.
+This setting was removed in Go 1.24.
 
 ### Go 1.10
 

doc/next/3-tools.md

@@ -2,6 +2,16 @@
 
 ### Go command {#go-command}
 
+The `go build` and `go install` commands now accept a `-json` flag that reports
+build output and failures as structured JSON output on standard output.
+For details of the reporting format, see `go help buildjson`.
+
+Furthermore, `go test -json` now reports build output and failures in JSON,
+interleaved with test result JSON.
+These are distinguished by new `Action` types, but if they cause problems in
+a test integration system, you can revert to the text build output by setting
+`GODEBUG=gotestjsonbuildtext=1`.
+
 ### Cgo {#cgo}
 
 Cgo currently refuses to compile calls to a C function which has multiple
@@ -20,3 +30,11 @@ non-existent identifiers. Some of these mistakes may cause tests not
 to run.
 
 This analyzer is among the subset of analyzers that are run by `go test`.
+
+### GOCACHEPROG
+
+The `cmd/go` internal binary and test caching mechanism can now be implemented
+by child processes implementing a JSON protocol between the `cmd/go` tool
+and the child process named by the `GOCACHEPROG` environment variable.
+This was previously behind a GOEXPERIMENT.
+For protocol details, see [#59719](/issue/59719).

doc/next/5-toolchain.md

@@ -1,5 +1,11 @@
 ## Compiler {#compiler}
 
+<!-- go.dev/issue/60725, go.dev/issue/57926 -->
+The compiler already disallowed defining new methods with receiver types that were
+cgo-generated, but it was possible to circumvent that restriction via an alias type.
+Go 1.24 now always reports an error if a receiver denotes a cgo-generated type,
+whether directly or indirectly (through an alias type).
+
 ## Assembler {#assembler}
 
 ## Linker {#linker}

doc/next/6-stdlib/1-os-root.md

@@ -0,0 +1,16 @@
+### Directory-limited filesystem access
+
+<!-- go.dev/issue/67002 -->
+The new [os.Root] type provides the ability to perform filesystem
+operations within a specific directory.
+
+The [os.OpenRoot] function opens a directory and returns an [os.Root].
+Methods on [os.Root] operate within the directory and do not permit
+paths that refer to locations outside the directory, including
+ones that follow symbolic links out of the directory.
+
+- [os.Root.Open] opens a file for reading.
+- [os.Root.Create] creates a file.
+- [os.Root.OpenFile] is the generalized open call.
+- [os.Root.Mkdir] creates a directory.
+

doc/next/6-stdlib/1-weak.md

@@ -0,0 +1,12 @@
+### New weak package
+
+The new [weak](/pkg/weak) package provides weak pointers.
+
+Weak pointers are a low-level primitive provided to enable the
+creation of memory-efficient structures, such as weak maps for
+associating values, canonicalization maps for anything not
+covered by package [unique](/pkg/unique), and various kinds
+of caches.
+For supporting these use-cases, this release also provides
+[runtime.AddCleanup](/pkg/runtime#AddCleanup) and
+[maphash.Comparable](/pkg/maphash#Comparable).

doc/next/6-stdlib/2-pbkdf2.md

@@ -0,0 +1,2 @@
+A new pbkdf2 [Key] derivation function was added, based on the pre-existing
+`golang.org/x/crypto/pbkdf2` package. <!-- go.dev/issue/69488 -->

doc/next/6-stdlib/3-hkdf.md

@@ -0,0 +1,2 @@
+A new `crypto/hkdf` package was added based on the pre-existing
+`golang.org/x/crypto/hkdf` package. <!-- go.dev/issue/61477 -->

doc/next/6-stdlib/4-mlkem.md

@@ -0,0 +1,3 @@
+A new `crypto/mlkem` package was added, implementing ML-KEM (formerly known as
+Kyber), as specified in [NIST FIPS 203](https://doi.org/10.6028/NIST.FIPS.203).
+<!-- go.dev/issue/70122 -->

doc/next/6-stdlib/5-sha3.md

@@ -0,0 +1,6 @@
+### New sha3 package
+
+The new [crypto/sha3] package implements the SHA-3 hash function, and SHAKE and
+cSHAKE extendable-output functions.
+
+It was imported from `golang.org/x/crypto/sha3`.

doc/next/6-stdlib/99-minor/crypto/cipher/69445.md

@@ -0,0 +1,5 @@
+[NewOFB], [NewCFBEncrypter], and [NewCFBDecrypter] are now deprecated. OFB and
+CFB mode are not authenticated, which generally enables active attacks to
+manipulate and recover the plaintext. It is recommended that applications use
+[AEAD] modes instead. If an unauthenticated [Stream] mode is required, use
+[NewCTR] instead.

doc/next/6-stdlib/99-minor/crypto/cipher/69981.md

@@ -0,0 +1,3 @@
+The new [NewGCMWithRandomNonce] function returns an [AEAD] that implements
+AES-GCM by generating a random nonce during Seal and prepending it to the
+ciphertext.

doc/next/6-stdlib/99-minor/crypto/fips140/70123.md

@@ -0,0 +1 @@
+<!-- FIPS 140 will be covered in its own section. -->

doc/next/6-stdlib/99-minor/crypto/hkdf/61477.md

@@ -0,0 +1 @@
+<!-- This is a new package; covered in 6-stdlib/3-hkdf.md. -->