{Name: "winsymlink", Package: "os", Changed: 22, Old: "0"},
	{Name: "x509keypairleaf", Package: "crypto/tls", Changed: 23, Old: "0"},
	{Name: "x509negativeserial", Package: "crypto/x509", Changed: 23, Old: "1"},
	{Name: "x509seriallength", Package: "crypto/x509", Changed: 23, Old: "1"},
	{Name: "x509sha1", Package: "crypto/x509"},
	{Name: "x509usefallbackroots", Package: "crypto/x509"},
	{Name: "x509usepolicies", Package: "crypto/x509"},

			out.UnhandledCriticalExtensions = append(out.UnhandledCriticalExtensions, e.Id)
		}
	}

	return nil
}

var x509negativeserial = godebug.New("x509negativeserial")
var x509seriallength = godebug.New("x509seriallength")

func parseCertificate(der []byte) (*Certificate, error) {
	cert := &Certificate{}

	input := cryptobyte.String(der)
	// we read the SEQUENCE including length and tag bytes so that

Go 1.23 changed the behavior of
[crypto/x509.ParseCertificate](/pkg/crypto/x509/#ParseCertificate) to reject
serial numbers that are longer than 20 octets. This change can be reverted with
the [`x509seriallength` setting](/pkg/crypto/x509/#ParseCertificate).

Go 1.23 re-enabled support in html/template for ECMAScript 6 template literals by default.
The [`jstmpllitinterp` setting](/pkg/html/template#hdr-Security_Model) no longer has

		setting.

	/godebug/non-default-behavior/x509seriallength:events
		The number of non-default behaviors executed by the crypto/x509
		package due to a non-default GODEBUG=x509seriallength=...
		setting.

	/godebug/non-default-behavior/x509sha1:events
		The number of non-default behaviors executed by the crypto/x509
		package due to a non-default GODEBUG=x509sha1=... setting.