Go 1.25 Release Candidate 2 is released

Hello gophers,

We have just released go1.25rc2, a release candidate version of Go 1.25.
It is cut from release-branch.go1.25 at the revision tagged go1.25rc2.

Please try your production load tests and unit tests with the new version.
Your help testing these pre-release versions is invaluable.

Report any problems using the issue tracker:
https://go.dev/issue/new

If you have Go installed already, an easy way to try go1.25rc2
is by using the go command:

$ go install golang.org/dl/go1.25rc2@latest
$ go1.25rc2 download

You can download binary and source distributions from the usual place:
https://go.dev/dl/#go1.25rc2

To find out what has changed in Go 1.25, read the draft release notes:
https://tip.golang.org/doc/go1.25

Cheers,
Carlos and David for the Go team

Hello gophers,

The go1.25rc2 release includes 1 security fix following the security policy:

• cmd/go: unexpected command execution in untrusted VCS repositories

  Various uses of the Go toolchain in untrusted VCS repositories can result in
  unexpected code execution. When using the Go toolchain in directories fetched
  using various VCS tools (such as directly cloning Git or Mercurial repositories)
  can cause the toolchain to execute unexpected commands, if said directory
  contains multiple VCS configuration metadata (such as a '.hg' directory in a Git
  repository). This is due to how the Go toolchain attempts to resolve which VCS
  is being used in order to embed build information in binaries and determine
  module versions.

  The toolchain will now abort attempting to resolve which VCS is being used if it
  detects multiple VCS configuration metadata in a module directory or nested VCS
  configuration metadata (such as a '.git' directoy in a parent directory and a
  '.hg' directory in a child directory). This will not prevent the toolchain from
  building modules, but will result in binaries omitting VCS related build
  information.

  If this behavior is expected by the user, the old behavior can be re-enabled by
  setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted
  repositories.

  Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting
  this issue.

  This is CVE-2025-4674 and https://go.dev/issue/74380.

Thanks to everyone who contributed to the release.