From 1c824616daf208b09ffa7640ff35ddfca2205060 Mon Sep 17 00:00:00 2001
From: "bot-for-go[bot]" <199222863+bot-for-go[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:54:14 +0000
Subject: [PATCH 1/3] Update submodule to latest master (5d5c7ff1):
 cmd/compile: fix mergelocals for arm32/s390x/riscv64

---
 go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go b/go
index 9f236fbe3f..5d5c7ff1f0 160000
--- a/go
+++ b/go
@@ -1 +1 @@
-Subproject commit 9f236fbe3fa00dfe1534148d84f505ddd770d3cf
+Subproject commit 5d5c7ff1f012bb70d653c1a2b282ee46161b6914

From b57d80dbb5a134242eb39f4b87add4c3647f3fbf Mon Sep 17 00:00:00 2001
From: George Adams <georgeadams1995@gmail.com>
Date: Thu, 23 Jul 2026 09:48:22 +0100
Subject: [PATCH 2/3] resolve 3-way merge conflicts

---
 .../0001-Vendor-external-dependencies.patch   | 12 +--
 patches/0002-Add-crypto-backends.patch        | 82 +++++++++----------
 patches/0007-Add-appinsights-telemetry.patch  |  6 +-
 3 files changed, 49 insertions(+), 51 deletions(-)

diff --git a/patches/0001-Vendor-external-dependencies.patch b/patches/0001-Vendor-external-dependencies.patch
index 64dce9d5f4..003eee514e 100644
--- a/patches/0001-Vendor-external-dependencies.patch
+++ b/patches/0001-Vendor-external-dependencies.patch
@@ -2734,7 +2734,7 @@ index 00000000000000..d4671e1584dfa8
 +// This file is here just to declare cryptobackend dependencies.
 +// This allows tracking their versions in a single patch file.
 diff --git a/src/go.mod b/src/go.mod
-index 31cff08cfb0658..a77e67a1a93fe2 100644
+index 5cd65aa1cd3b98..f5bfb18d430e91 100644
 --- a/src/go.mod
 +++ b/src/go.mod
 @@ -3,11 +3,17 @@ module std
@@ -2742,7 +2742,7 @@ index 31cff08cfb0658..a77e67a1a93fe2 100644
  
  require (
 -	golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1
--	golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435
+-	golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb
 +	github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f // indirect
 +	github.com/microsoft/go-crypto-openssl v0.5.1-0.20260702080831-779d2f80165b // indirect
 +	github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 // indirect
@@ -2755,12 +2755,12 @@ index 31cff08cfb0658..a77e67a1a93fe2 100644
 -	golang.org/x/text v0.40.0 // indirect
 +	github.com/microsoft/go/cryptobackend v0.0.0
 +	golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1
-+	golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435
++	golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb
  )
 +
 +replace github.com/microsoft/go/cryptobackend => ../../cryptobackend
 diff --git a/src/go.sum b/src/go.sum
-index 829e8fbf4b3026..4305da5bd0ebb4 100644
+index f540571ca5387d..6fcb1c79d85259 100644
 --- a/src/go.sum
 +++ b/src/go.sum
 @@ -1,3 +1,9 @@
@@ -2772,7 +2772,7 @@ index 829e8fbf4b3026..4305da5bd0ebb4 100644
 +github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw=
  golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 h1:vGPAn+SBeT/HVkWqXTwgapJgtGQJztG0WR0OTuHzMAI=
  golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
- golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435 h1:F2VkyVpi+/NElkyxEdnKyWzMLTGeSpJBbLgHJKS1rJ0=
+ golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb h1:4Zpnuj4Vkh1c0wOa1MvxIp+I66KR18NRN08y9bN5zL0=
 diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
 index 4959a421892996..67627cdb93ff22 100644
 --- a/src/go/build/deps_test.go
@@ -45251,7 +45251,7 @@ index 00000000000000..b7ffeea07c6b8d
 +	panic("cryptobackend: not available")
 +}
 diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
-index 3592a83513f392..0490c07ab49be1 100644
+index 6a02c35f7fafa9..615c8913d5e262 100644
 --- a/src/vendor/modules.txt
 +++ b/src/vendor/modules.txt
 @@ -1,3 +1,57 @@
diff --git a/patches/0002-Add-crypto-backends.patch b/patches/0002-Add-crypto-backends.patch
index 27f48ec149..fded21cbb6 100644
--- a/patches/0002-Add-crypto-backends.patch
+++ b/patches/0002-Add-crypto-backends.patch
@@ -328,7 +328,7 @@ index 78d55bec559987..decf356a449ba9 100644
  	if debug {
  		run("", ShowOutput|CheckExit, pathf("%s/compile", tooldir), "-V=full")
 diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
-index 43ac003c7907c7..4daeb1a5ced0eb 100644
+index da2ebaabe5c82a..e3cb79ae4b8aed 100644
 --- a/src/cmd/dist/test.go
 +++ b/src/cmd/dist/test.go
 @@ -158,10 +158,12 @@ func (t *tester) run() {
@@ -358,7 +358,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
  		}
  	}
  
-@@ -731,7 +733,7 @@ func (t *tester) registerTests() {
+@@ -717,7 +719,7 @@ func (t *tester) registerTests() {
  	})
  
  	// Check that all crypto packages compile (and test correctly, in longmode) with fips.
@@ -367,7 +367,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
  		// Test standard crypto packages with fips140=on.
  		t.registerTest("GOFIPS140=latest go test crypto/...", &goTest{
  			variant: "gofips140",
-@@ -795,7 +797,9 @@ func (t *tester) registerTests() {
+@@ -781,7 +783,9 @@ func (t *tester) registerTests() {
  	}
  
  	// Test ios/amd64 for the iOS simulator.
@@ -378,7 +378,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
  		t.registerTest("GOOS=ios on darwin/amd64",
  			&goTest{
  				variant:  "amd64ios",
-@@ -1044,7 +1048,9 @@ func (t *tester) registerTests() {
+@@ -1018,7 +1022,9 @@ func (t *tester) registerTests() {
  		t.registerRaceTests()
  	}
  
@@ -389,7 +389,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
  		// Only start multiple test dir shards on builders,
  		// where they get distributed to multiple machines.
  		// See issues 20141 and 31834.
-@@ -1401,12 +1407,11 @@ func (t *tester) registerCgoTests(heading string) {
+@@ -1374,12 +1380,11 @@ func (t *tester) registerCgoTests(heading string) {
  			// a C linker warning on Linux.
  			// in function `bio_ip_and_port_to_socket_and_addr':
  			// warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
@@ -403,7 +403,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
  			// Static linking tests
  			if goos != "android" && p != "netbsd/arm" && !t.msan && !t.asan {
  				// TODO(#56629): Why does this fail on netbsd-arm?
-@@ -1929,3 +1934,28 @@ func goexperiments(exps ...string) string {
+@@ -1902,3 +1907,28 @@ func goexperiments(exps ...string) string {
  	return existing + strings.Join(exps, ",")
  
  }
@@ -467,7 +467,7 @@ index ed0fbf3d53d75b..a2f74c8095d449 100644
  func TestBoringInternalLink(t *testing.T) {
  	tg := testgo(t)
 diff --git a/src/cmd/go/go_test.go b/src/cmd/go/go_test.go
-index 47839e0229b951..99ac16a3951934 100644
+index 724d446833a23d..cbc491facb3491 100644
 --- a/src/cmd/go/go_test.go
 +++ b/src/cmd/go/go_test.go
 @@ -14,6 +14,7 @@ import (
@@ -492,7 +492,7 @@ index 47839e0229b951..99ac16a3951934 100644
  
  		if testGOROOT := os.Getenv("TESTGO_GOROOT"); testGOROOT != "" {
  			// Disallow installs to the GOROOT from which testgo was built.
-@@ -1779,6 +1787,9 @@ func TestGenerateUsesBuildContext(t *testing.T) {
+@@ -1729,6 +1737,9 @@ func TestGenerateUsesBuildContext(t *testing.T) {
  }
  
  func TestGoEnv(t *testing.T) {
@@ -503,7 +503,7 @@ index 47839e0229b951..99ac16a3951934 100644
  	tg.parallel()
  	defer tg.cleanup()
 diff --git a/src/cmd/go/internal/cfg/cfg.go b/src/cmd/go/internal/cfg/cfg.go
-index 78cbbb949e7c27..38bf1efb8794da 100644
+index 5c34612f5d2a95..43d9fea576d302 100644
 --- a/src/cmd/go/internal/cfg/cfg.go
 +++ b/src/cmd/go/internal/cfg/cfg.go
 @@ -14,11 +14,13 @@ import (
@@ -520,7 +520,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644
  	"strings"
  	"sync"
  	"time"
-@@ -229,6 +231,21 @@ func ForceHost() {
+@@ -234,6 +236,21 @@ func ForceHost() {
  	BuildContext = defaultContext()
  	// Call SetGOROOT to properly set the GOROOT on the new context.
  	SetGOROOT(Getenv("GOROOT"), false)
@@ -542,7 +542,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644
  	// Recompute experiments: the settings determined depend on GOOS and GOARCH.
  	// This will also update the BuildContext's tool tags to include the new
  	// experiment tags.
-@@ -311,10 +328,23 @@ func computeExperiment() {
+@@ -316,10 +333,23 @@ func computeExperiment() {
  
  	// Add build tags based on the experiments in effect.
  	exps := Experiment.Enabled()
@@ -568,7 +568,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644
  }
  
 diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go
-index 3d72c368b088a2..4fe28740a6e3c2 100644
+index e648110e0136a8..c8e949c5e933ec 100644
 --- a/src/cmd/go/internal/envcmd/env.go
 +++ b/src/cmd/go/internal/envcmd/env.go
 @@ -124,6 +124,7 @@ func MkEnv() []cfg.EnvVar {
@@ -603,7 +603,7 @@ index b305457a23d104..5154aa0be0007c 100644
  Additional information available from 'go env' but not read from the environment:
  
 diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
-index 2985cff67cec0b..d345585b33be9a 100644
+index 6c1e51e1a3e0a8..99fa0aa07259a9 100644
 --- a/src/cmd/go/internal/load/pkg.go
 +++ b/src/cmd/go/internal/load/pkg.go
 @@ -16,6 +16,7 @@ import (
@@ -614,7 +614,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
  	"io/fs"
  	"os"
  	pathpkg "path"
-@@ -934,7 +935,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
+@@ -919,7 +920,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
  		}
  		if r.dir != "" {
  			var buildMode build.ImportMode
@@ -623,7 +623,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
  			if !cfg.ModulesEnabled {
  				buildMode = build.ImportComment
  			} else {
-@@ -950,7 +951,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
+@@ -935,7 +936,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
  			}
  			if modroot != "" {
  				if rp, err := modindex.GetPackage(modroot, r.dir); err == nil {
@@ -632,7 +632,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
  					goto Happy
  				} else if !errors.Is(err, modindex.ErrNotIndexed) {
  					base.Fatal(err)
-@@ -998,7 +999,8 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
+@@ -983,7 +984,8 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
  				// Not vendoring, or we already found the vendored path.
  				buildMode |= build.IgnoreVendor
  			}
@@ -642,7 +642,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
  		}
  		data.p.ImportPath = r.path
  
-@@ -1023,6 +1025,42 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
+@@ -1008,6 +1010,42 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
  	return p, loaded, err
  }
  
@@ -685,7 +685,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
  // importSpec describes an import declaration in source code. It is used as a
  // cache key for resolvedImportCache.
  type importSpec struct {
-@@ -1548,6 +1586,9 @@ func disallowInternal(ld *modload.Loader, ctx context.Context, srcDir string, im
+@@ -1533,6 +1571,9 @@ func disallowInternal(ld *modload.Loader, ctx context.Context, srcDir string, im
  		}
  		goto Error
  	}
@@ -695,7 +695,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
  
  	if p.Module == nil {
  		parent := p.Dir[:i+len(p.Dir)-len(p.ImportPath)]
-@@ -2458,6 +2499,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS
+@@ -2447,6 +2488,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS
  			buildmode = "archive"
  		}
  	}
@@ -706,10 +706,10 @@ index 2985cff67cec0b..d345585b33be9a 100644
  	appendSetting("-compiler", cfg.BuildContext.Compiler)
  	if gccgoflags := BuildGccgoflags.String(); gccgoflags != "" && cfg.BuildContext.Compiler == "gccgo" {
 diff --git a/src/cmd/go/internal/tool/tool.go b/src/cmd/go/internal/tool/tool.go
-index 97c27c8caa44d6..bb18bb112a314a 100644
+index afc50d9b2d9177..cfa89ae75621ef 100644
 --- a/src/cmd/go/internal/tool/tool.go
 +++ b/src/cmd/go/internal/tool/tool.go
-@@ -335,6 +335,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
+@@ -336,6 +336,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
  	// Override GOOS and GOARCH for the build to build the tool using
  	// the same GOOS and GOARCH as this go command.
  	cfg.ForceHost()
@@ -720,7 +720,7 @@ index 97c27c8caa44d6..bb18bb112a314a 100644
  
  	// Ignore go.mod and go.work: we don't need them, and we want to be able
  	// to run the tool even if there's an issue with the module or workspace the
-@@ -342,8 +346,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
+@@ -343,8 +347,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
  	ld.RootMode = modload.NoRoot
  
  	runFunc := func(b *work.Builder, ctx context.Context, a *work.Action) error {
@@ -734,7 +734,7 @@ index 97c27c8caa44d6..bb18bb112a314a 100644
  
  	buildAndRunTool(ld, ctx, tool, args, runFunc)
 diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go
-index 6033ec420b8452..a8374234a3f0a5 100644
+index e9b386ec660cd0..7166e102d837ae 100644
 --- a/src/cmd/go/script_test.go
 +++ b/src/cmd/go/script_test.go
 @@ -300,6 +300,9 @@ var extraEnvKeys = []string{
@@ -1239,7 +1239,7 @@ index acbebf28598a9c..6ef32735ddfd57 100644
  			*mode = BuildModePIE
  		default:
 diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
-index 9cbc12919f1d00..e64a9c5299e95a 100644
+index b7ff79c0958bab..c86ccff3e325b2 100644
 --- a/src/cmd/link/internal/ld/lib.go
 +++ b/src/cmd/link/internal/ld/lib.go
 @@ -1177,6 +1177,12 @@ var hostobj []Hostobj
@@ -2898,7 +2898,7 @@ index a4c9fc977bc136..116106bd0a4cfb 100644
  
  // MustMinimumFIPS140ModuleVersion skips the test if compiled against a lower
 diff --git a/src/crypto/internal/cryptotest/hash.go b/src/crypto/internal/cryptotest/hash.go
-index 37fd96a2d9d0b9..6d4b190831d57d 100644
+index 3e2efa84db720c..4e631a32de56da 100644
 --- a/src/crypto/internal/cryptotest/hash.go
 +++ b/src/crypto/internal/cryptotest/hash.go
 @@ -5,7 +5,6 @@
@@ -2909,10 +2909,10 @@ index 37fd96a2d9d0b9..6d4b190831d57d 100644
  	"crypto/internal/fips140"
  	"hash"
  	"internal/testhash"
-@@ -20,7 +19,7 @@ type MakeHash func() hash.Hash
- // TestHash performs a set of tests on hash.Hash implementations, checking the
- // documented requirements of Write, Sum, Reset, Size, and BlockSize.
- func TestHash(t *testing.T, mh MakeHash) {
+@@ -34,7 +33,7 @@ func TestHash(t *testing.T, mh MakeHash) {
+ 		h.Sum(end[:0])
+ 	})
+ 
 -	if boring.Enabled || fips140.Version() == "v1.0.0" {
 +	if fips140.Version() == "v1.0.0" {
  		testhash.TestHashWithoutClone(t, testhash.MakeHash(mh))
@@ -3254,7 +3254,7 @@ index 403ff2881f4b68..9cf1efbbeed819 100644
  
  func maybeCloner(h hash.Hash) any {
 diff --git a/src/crypto/mldsa/mldsa_fips140v1.26.go b/src/crypto/mldsa/mldsa_fips140v1.26.go
-index 2c36fe191e9149..24308c7391ee67 100644
+index d3ee1f0daec096..c37363dd9d2662 100644
 --- a/src/crypto/mldsa/mldsa_fips140v1.26.go
 +++ b/src/crypto/mldsa/mldsa_fips140v1.26.go
 @@ -9,8 +9,13 @@ package mldsa
@@ -3423,8 +3423,8 @@ index 2c36fe191e9149..24308c7391ee67 100644
  var errInvalidSignerOpts = errors.New("mldsa: invalid SignerOpts")
  
  // Sign returns a signature of the given message using this private key.
-@@ -112,9 +227,21 @@ func (sk *PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts)
- 		if opts, ok := opts.(*Options); ok {
+@@ -115,9 +230,21 @@ func (sk *PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts)
+ 		if opts, ok := opts.(*Options); ok && opts != nil {
  			context = opts.Context
  		}
 +		if sk.boring != nil {
@@ -3446,7 +3446,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  	default:
  		return nil, errInvalidSignerOpts
  	}
-@@ -126,15 +253,21 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
+@@ -132,15 +259,21 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
  	if opts == nil {
  		opts = &Options{}
  	}
@@ -3459,7 +3459,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  	switch opts.HashFunc() {
  	case 0:
  		var context string
- 		if opts, ok := opts.(*Options); ok {
+ 		if opts, ok := opts.(*Options); ok && opts != nil {
  			context = opts.Context
  		}
 -		return mldsa.SignDeterministic(&sk.k, message, context)
@@ -3470,7 +3470,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  	default:
  		return nil, errInvalidSignerOpts
  	}
-@@ -146,6 +279,12 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
+@@ -152,6 +285,12 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
  // A PublicKey is safe for concurrent use.
  type PublicKey struct {
  	p mldsa.PublicKey
@@ -3483,7 +3483,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  }
  
  // NewPublicKey creates a new ML-DSA public key from the given encoding.
-@@ -154,6 +293,14 @@ func NewPublicKey(params Parameters, encoding []byte) (*PublicKey, error) {
+@@ -160,6 +299,14 @@ func NewPublicKey(params Parameters, encoding []byte) (*PublicKey, error) {
  }
  
  func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKey, error) {
@@ -3498,7 +3498,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  	var err error
  	var pk *mldsa.PublicKey
  	switch params {
-@@ -175,6 +322,9 @@ func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKe
+@@ -181,6 +328,9 @@ func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKe
  
  // Bytes returns the public key encoding.
  func (pk *PublicKey) Bytes() []byte {
@@ -3508,7 +3508,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  	return pk.p.Bytes()
  }
  
-@@ -187,11 +337,29 @@ func (pk *PublicKey) Equal(x crypto.PublicKey) bool {
+@@ -193,11 +343,29 @@ func (pk *PublicKey) Equal(x crypto.PublicKey) bool {
  	if !ok || other == nil {
  		return false
  	}
@@ -3538,7 +3538,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  	switch pk.p.Parameters() {
  	case "ML-DSA-44":
  		return MLDSA44()
-@@ -213,5 +381,8 @@ func Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) erro
+@@ -222,5 +390,8 @@ func Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) erro
  	if opts == nil {
  		opts = &Options{}
  	}
@@ -3548,7 +3548,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
  	return mldsa.Verify(&pk.p, message, signature, opts.Context)
  }
 diff --git a/src/crypto/mldsa/mldsa_test.go b/src/crypto/mldsa/mldsa_test.go
-index 375333a70cf686..c319bfe3d98f42 100644
+index 0a2fc4edf11183..9c27ff51b27a4f 100644
 --- a/src/crypto/mldsa/mldsa_test.go
 +++ b/src/crypto/mldsa/mldsa_test.go
 @@ -18,6 +18,9 @@ import (
@@ -4892,7 +4892,7 @@ index 46e47df1d32cf2..48e9bd510cf92e 100644
  	d.Reset()
  	d.Write(data)
 diff --git a/src/crypto/sha1/sha1_test.go b/src/crypto/sha1/sha1_test.go
-index ef6e5ddcbb2d97..b1af8757599a9d 100644
+index 8b4618df556271..ae4abc9edfa7c1 100644
 --- a/src/crypto/sha1/sha1_test.go
 +++ b/src/crypto/sha1/sha1_test.go
 @@ -8,10 +8,11 @@ package sha1
diff --git a/patches/0007-Add-appinsights-telemetry.patch b/patches/0007-Add-appinsights-telemetry.patch
index 89a3bd1059..f1f40d9948 100644
--- a/patches/0007-Add-appinsights-telemetry.patch
+++ b/patches/0007-Add-appinsights-telemetry.patch
@@ -192,7 +192,7 @@ index 00000000000000..010270fb6ad4cf
 +	return appInsightsRequests.Load()
 +}
 diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go
-index c66d0179529637..38beab83d06401 100644
+index 82f2569817ad04..425c7442e201b4 100644
 --- a/src/cmd/go/script_test.go
 +++ b/src/cmd/go/script_test.go
 @@ -62,6 +62,7 @@ func TestScript(t *testing.T) {
@@ -214,7 +214,7 @@ index c66d0179529637..38beab83d06401 100644
  		"newline=\n",
  	}
  
-@@ -412,6 +417,11 @@ func checkCounters(t *testing.T, telemetryDir string) {
+@@ -412,4 +417,9 @@ func checkCounters(t *testing.T, telemetryDir string) {
  			t.Fatal("go was invoked but no counters were incremented")
  		}
  	}
@@ -224,8 +224,6 @@ index c66d0179529637..38beab83d06401 100644
 +		}
 +	}
  }
- 
- // Copied from https://go.googlesource.com/telemetry/+/5f08a0cbff3f/internal/telemetry/mode.go#122
 diff --git a/src/cmd/go/scriptcmds_test.go b/src/cmd/go/scriptcmds_test.go
 index 8195e830caa31b..882aeecfa562b9 100644
 --- a/src/cmd/go/scriptcmds_test.go

From 5270ed292d182dcad0c96576a70f38a5f093ff75 Mon Sep 17 00:00:00 2001
From: George Adams <georgeadams1995@gmail.com>
Date: Fri, 31 Jul 2026 15:08:16 +0100
Subject: [PATCH 3/3] pull in fakecgo fix

---
 .../0001-Vendor-external-dependencies.patch   | 140 +++++++++++++-----
 1 file changed, 101 insertions(+), 39 deletions(-)

diff --git a/patches/0001-Vendor-external-dependencies.patch b/patches/0001-Vendor-external-dependencies.patch
index a55dc39f0a..262a83316c 100644
--- a/patches/0001-Vendor-external-dependencies.patch
+++ b/patches/0001-Vendor-external-dependencies.patch
@@ -139,10 +139,10 @@ Use a 'go' that was recently built by the current branch to ensure stable result
  .../internal/fakecgo/fakecgo.lock             |    3 +
  .../internal/fakecgo/freebsd.go               |   29 +
  .../internal/fakecgo/generate.go              |    6 +
- .../internal/fakecgo/go_darwin.go             |   90 +
- .../internal/fakecgo/go_freebsd.go            |   81 +
+ .../internal/fakecgo/go_darwin.go             |   88 +
+ .../internal/fakecgo/go_freebsd.go            |   79 +
  .../internal/fakecgo/go_libinit.go            |   74 +
- .../internal/fakecgo/go_linux.go              |   81 +
+ .../internal/fakecgo/go_linux.go              |   79 +
  .../internal/fakecgo/go_setenv.go             |   20 +
  .../internal/fakecgo/go_util.go               |   40 +
  .../internal/fakecgo/iscgo.go                 |   21 +
@@ -152,8 +152,10 @@ Use a 'go' that was recently built by the current branch to ensure stable result
  .../internal/fakecgo/libcgo_linux.go          |   22 +
  .../internal/fakecgo/linux.go                 |  186 ++
  .../internal/fakecgo/setenv.go                |   21 +
+ .../internal/fakecgo/threadentry_amd64.go     |   17 +
+ .../internal/fakecgo/threadentry_noasm.go     |   26 +
  .../internal/fakecgo/trampolines_386.s        |  123 +
- .../internal/fakecgo/trampolines_amd64.s      |  109 +
+ .../internal/fakecgo/trampolines_amd64.s      |  126 +
  .../internal/fakecgo/trampolines_arm.s        |  124 +
  .../internal/fakecgo/trampolines_arm64.s      |   83 +
  .../internal/fakecgo/trampolines_linux_386.s  |   80 +
@@ -420,7 +422,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result
  .../go/cryptobackend/tls13/tls13_openssl.go   |   18 +
  .../go/cryptobackend/tls13/tls13_windows.go   |   14 +
  src/vendor/modules.txt                        |   55 +
- 412 files changed, 39651 insertions(+), 11 deletions(-)
+ 414 files changed, 39705 insertions(+), 11 deletions(-)
  create mode 100644 src/cmd/internal/telemetry/counter/deps_ignore.go
  create mode 100644 src/cmd/vendor/github.com/microsoft/go-infra/telemetry/LICENSE
  create mode 100644 src/cmd/vendor/github.com/microsoft/go-infra/telemetry/README.md
@@ -558,6 +560,8 @@ Use a 'go' that was recently built by the current branch to ensure stable result
  create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/libcgo_linux.go
  create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/linux.go
  create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/setenv.go
+ create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_amd64.go
+ create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_noasm.go
  create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_386.s
  create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_amd64.s
  create mode 100644 src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_arm.s
@@ -2734,7 +2738,7 @@ index 00000000000000..d4671e1584dfa8
 +// This file is here just to declare cryptobackend dependencies.
 +// This allows tracking their versions in a single patch file.
 diff --git a/src/go.mod b/src/go.mod
-index 31cff08cfb0658..4fbf327344f9f2 100644
+index 5cd65aa1cd3b98..6c38eb85ec32be 100644
 --- a/src/go.mod
 +++ b/src/go.mod
 @@ -3,11 +3,17 @@ module std
@@ -2744,7 +2748,7 @@ index 31cff08cfb0658..4fbf327344f9f2 100644
 -	golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1
 -	golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb
 +	github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f // indirect
-+	github.com/microsoft/go-crypto-openssl v0.5.1-0.20260728092821-b4aef158c3ae // indirect
++	github.com/microsoft/go-crypto-openssl v0.5.1-0.20260731132607-9fc2a2ab131d // indirect
 +	github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 // indirect
 +	golang.org/x/sys v0.47.0 // indirect
 +	golang.org/x/text v0.40.0 // indirect
@@ -2760,18 +2764,14 @@ index 31cff08cfb0658..4fbf327344f9f2 100644
 +
 +replace github.com/microsoft/go/cryptobackend => ../../cryptobackend
 diff --git a/src/go.sum b/src/go.sum
-<<<<<<< HEAD
-index f540571ca5387d..6fcb1c79d85259 100644
-=======
-index 829e8fbf4b3026..fe83c8851ce90d 100644
->>>>>>> upstream/microsoft/main
+index f540571ca5387d..363dffe7c44517 100644
 --- a/src/go.sum
 +++ b/src/go.sum
 @@ -1,3 +1,9 @@
 +github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f h1:ksW7MznRoTYAoBaNIKyjqxR0Tp0aUqY1eALRaerngnk=
 +github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f/go.mod h1:QahyqOoEDhEJ08aC1WtiWq691LyNgXq3qrjI4QmdPzM=
-+github.com/microsoft/go-crypto-openssl v0.5.1-0.20260728092821-b4aef158c3ae h1:xSoD74/EAMa3AWS7h6+fWoBzTu4Yqh5J5X7dYdYNxkg=
-+github.com/microsoft/go-crypto-openssl v0.5.1-0.20260728092821-b4aef158c3ae/go.mod h1:gJrjX+yWGi9pkbfPVDDh+ZbgjtQoRSXHjb/ZyjwKk34=
++github.com/microsoft/go-crypto-openssl v0.5.1-0.20260731132607-9fc2a2ab131d h1:Whi7ZQB1mjFKhFHiKtyxCYg0OlI+MnNpwcH47+T/Vdw=
++github.com/microsoft/go-crypto-openssl v0.5.1-0.20260731132607-9fc2a2ab131d/go.mod h1:gJrjX+yWGi9pkbfPVDDh+ZbgjtQoRSXHjb/ZyjwKk34=
 +github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 h1:nmQ1K/L5GISW8UwbUwE376h3WXREEpREFdc3fNklcXc=
 +github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw=
  golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 h1:vGPAn+SBeT/HVkWqXTwgapJgtGQJztG0WR0OTuHzMAI=
@@ -15624,12 +15624,12 @@ index 00000000000000..17c6f83475ce5e
 +func call5(fn, a1, a2, a3, a4, a5 uintptr) uintptr
 diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/fakecgo.lock b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/fakecgo.lock
 new file mode 100644
-index 00000000000000..b835f8a4ac2e89
+index 00000000000000..eaf9e8639e2c13
 --- /dev/null
 +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/fakecgo.lock
 @@ -0,0 +1,3 @@
 +{
-+  "commit_hash": "d476432ce7e3d8bb64b7cd257d332ee221ed6e7b"
++  "commit_hash": "077e9d53635a94054efc341688c8e1e7ed499382"
 +}
 diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/freebsd.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/freebsd.go
 new file mode 100644
@@ -15680,10 +15680,10 @@ index 00000000000000..88c4cdf9ec04cc
 +//go:generate go run update_tool.go
 diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_darwin.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_darwin.go
 new file mode 100644
-index 00000000000000..e49117058f381e
+index 00000000000000..45b3a058e2b5f1
 --- /dev/null
 +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_darwin.go
-@@ -0,0 +1,90 @@
+@@ -0,0 +1,88 @@
 +// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT.
 +
 +// Copyright 2011 The Go Authors. All rights reserved.
@@ -15743,9 +15743,7 @@ index 00000000000000..e49117058f381e
 +	//#endif
 +	setg_trampoline(setg_func, uintptr(unsafe.Pointer(ts.g)))
 +
-+	// faking funcs in go is a bit a... involved - but the following works :)
-+	fn := uintptr(unsafe.Pointer(&ts.fn))
-+	(*(*func())(unsafe.Pointer(&fn)))()
++	callThreadEntryFn(ts.fn)
 +
 +	return nil
 +}
@@ -15776,10 +15774,10 @@ index 00000000000000..e49117058f381e
 +}
 diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_freebsd.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_freebsd.go
 new file mode 100644
-index 00000000000000..37c6b50e2e6e85
+index 00000000000000..92f946ddbbf415
 --- /dev/null
 +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_freebsd.go
-@@ -0,0 +1,81 @@
+@@ -0,0 +1,79 @@
 +// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT.
 +
 +// Copyright 2011 The Go Authors. All rights reserved.
@@ -15833,9 +15831,7 @@ index 00000000000000..37c6b50e2e6e85
 +
 +	setg_trampoline(setg_func, uintptr(unsafe.Pointer(ts.g)))
 +
-+	// faking funcs in go is a bit a... involved - but the following works :)
-+	fn := uintptr(unsafe.Pointer(&ts.fn))
-+	(*(*func())(unsafe.Pointer(&fn)))()
++	callThreadEntryFn(ts.fn)
 +
 +	return nil
 +}
@@ -15943,10 +15939,10 @@ index 00000000000000..38ba01bb4f273d
 +}
 diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_linux.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_linux.go
 new file mode 100644
-index 00000000000000..2018c6dc2e1b85
+index 00000000000000..781915f77d67c9
 --- /dev/null
 +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_linux.go
-@@ -0,0 +1,81 @@
+@@ -0,0 +1,79 @@
 +// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT.
 +
 +// Copyright 2011 The Go Authors. All rights reserved.
@@ -16000,9 +15996,7 @@ index 00000000000000..2018c6dc2e1b85
 +
 +	setg_trampoline(setg_func, uintptr(unsafe.Pointer(ts.g)))
 +
-+	// faking funcs in go is a bit a... involved - but the following works :)
-+	fn := uintptr(unsafe.Pointer(&ts.fn))
-+	(*(*func())(unsafe.Pointer(&fn)))()
++	callThreadEntryFn(ts.fn)
 +
 +	return nil
 +}
@@ -16483,6 +16477,61 @@ index 00000000000000..30b9e8eb88c83d
 +//go:linkname _cgo_unsetenv runtime._cgo_unsetenv
 +var x_cgo_unsetenv_trampoline byte
 +var _cgo_unsetenv = &x_cgo_unsetenv_trampoline
+diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_amd64.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_amd64.go
+new file mode 100644
+index 00000000000000..5c5b4625b90f62
+--- /dev/null
++++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_amd64.go
+@@ -0,0 +1,17 @@
++// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT.
++
++// SPDX-License-Identifier: Apache-2.0
++// SPDX-FileCopyrightText: 2026 The Ebitengine Authors
++
++//go:build !cgo && amd64 && (darwin || freebsd || linux)
++
++package fakecgo
++
++// callThreadEntryFn calls fn (runtime.mstart) while saving and restoring the
++// frame pointer and other callee-saved registers around the call. mstart
++// returns with BP clobbered, so without this shim the caller's frame-pointer
++// epilogue would fault. Implemented in trampolines_amd64.s.
++//
++//go:nosplit
++//go:norace
++func callThreadEntryFn(fn uintptr)
+diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_noasm.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_noasm.go
+new file mode 100644
+index 00000000000000..f73a6cd2d6780b
+--- /dev/null
++++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/threadentry_noasm.go
+@@ -0,0 +1,26 @@
++// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT.
++
++// SPDX-License-Identifier: Apache-2.0
++// SPDX-FileCopyrightText: 2026 The Ebitengine Authors
++
++//go:build !cgo && !amd64 && (darwin || freebsd || linux)
++
++package fakecgo
++
++import "unsafe"
++
++// callThreadEntryFn calls fn (runtime.mstart). On architectures without the
++// amd64 frame-pointer epilogue issue this is a plain indirect call. It must be
++// nosplit and norace like the threadentry callers so it neither inserts a
++// morestack preamble nor runs race instrumentation during the fragile
++// thread-bootstrap window.
++//
++//go:nosplit
++//go:norace
++func callThreadEntryFn(fn uintptr) {
++	// fn is the code pointer. Build a func value whose first word is fn by
++	// pointing the closure at &fn, then call it (same trick fakecgo has always
++	// used to call a raw PC from Go).
++	fnPtr := uintptr(unsafe.Pointer(&fn))
++	(*(*func())(unsafe.Pointer(&fnPtr)))()
++}
 diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_386.s b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_386.s
 new file mode 100644
 index 00000000000000..80a9e968c6a8cd
@@ -16614,10 +16663,10 @@ index 00000000000000..80a9e968c6a8cd
 +	RET
 diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_amd64.s b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_amd64.s
 new file mode 100644
-index 00000000000000..049e2bbb1e7f44
+index 00000000000000..f6f09c6b2fc7d6
 --- /dev/null
 +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/trampolines_amd64.s
-@@ -0,0 +1,109 @@
+@@ -0,0 +1,126 @@
 +// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT.
 +
 +// SPDX-License-Identifier: Apache-2.0
@@ -16705,6 +16754,23 @@ index 00000000000000..049e2bbb1e7f44
 +	POP_REGS_HOST_TO_ABI0()
 +	RET
 +
++// func callThreadEntryFn(fn uintptr)
++// Calls fn (runtime.mstart) with the frame pointer and other callee-saved
++// registers saved on the stack across the call. mstart returns with BP
++// clobbered (BP==0); saving/restoring BP here (as real cgo's crosscall does)
++// keeps the caller's frame-pointer LEAVE epilogue valid on return.
++TEXT ·callThreadEntryFn(SB), NOSPLIT, $0-8
++	MOVQ fn+0(FP), R11
++	PUSH_REGS_HOST_TO_ABI0()
++
++	// X15 is designated by Go as a fixed zero register.
++	PXOR X15, X15
++
++	CALL R11
++
++	POP_REGS_HOST_TO_ABI0()
++	RET
++
 +TEXT ·call5(SB), NOSPLIT, $0-56
 +	MOVQ fn+0(FP), R11
 +	MOVQ a1+8(FP), DI
@@ -45255,11 +45321,7 @@ index 00000000000000..b7ffeea07c6b8d
 +	panic("cryptobackend: not available")
 +}
 diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
-<<<<<<< HEAD
-index 6a02c35f7fafa9..615c8913d5e262 100644
-=======
-index 3592a83513f392..7e4233d48fc0ec 100644
->>>>>>> upstream/microsoft/main
+index 6a02c35f7fafa9..d46e368a70e8f2 100644
 --- a/src/vendor/modules.txt
 +++ b/src/vendor/modules.txt
 @@ -1,3 +1,57 @@
@@ -45272,7 +45334,7 @@ index 3592a83513f392..7e4233d48fc0ec 100644
 +github.com/microsoft/go-crypto-darwin/internal/security
 +github.com/microsoft/go-crypto-darwin/internal/xsyscall
 +github.com/microsoft/go-crypto-darwin/xcrypto
-+# github.com/microsoft/go-crypto-openssl v0.5.1-0.20260728092821-b4aef158c3ae
++# github.com/microsoft/go-crypto-openssl v0.5.1-0.20260731132607-9fc2a2ab131d
 +## explicit; go 1.25
 +github.com/microsoft/go-crypto-openssl/bbig
 +github.com/microsoft/go-crypto-openssl/internal/fakecgo