// If the offset is non-sensible, then this uses an offset of zero.
func timeZone(offset time.Duration) *time.Location {
	const (
		minOffset   = -12 * time.Hour  // E.g., Baker island at -12:00
		maxOffset   = +14 * time.Hour  // E.g., Line island at +14:00
		offsetAlias = 15 * time.Minute // E.g., Nepal at +5:45
	)
	offset = offset.Round(offsetAlias)
	if offset < minOffset || maxOffset < offset {

zipp==3.21.0 \
    --hash=sha256:2c9958f6430a2040341a52eb608ed6dd93ef4392e02ffe219417c1b28b5dd1f4 \
    --hash=sha256:ac1bbe05fd2991f160ebce24ffbac5f6d11d83dc90891255885223d42b3cd931
    # via importlib-metadata
zstandard==0.23.0 \
    --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
    --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \

Go 1.24 also removed X25519Kyber768Draft00 and the Go 1.23 `tlskyber` setting.

Go 1.24 made [`ParsePKCS1PrivateKey`](/pkg/crypto/x509/#ParsePKCS1PrivateKey)
use and validate the CRT parameters in the encoded private key. This behavior
can be controlled with the `x509rsacrt` setting. Using `x509rsacrt=0` restores
the Go 1.23 behavior.

### Go 1.23

Go 1.23 changed the channels created by package time to be unbuffered

    --hash=sha256:ffa565331890b90056c01db69c0fe634a776f8019c143a5ae265f9c6bc4bd6d4
    # via -r ci/official/requirements_updater/requirements.in
zstandard==0.23.0 \
    --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
    --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \

    --hash=sha256:ffa565331890b90056c01db69c0fe634a776f8019c143a5ae265f9c6bc4bd6d4
    # via -r ci/official/requirements_updater/requirements.in
zstandard==0.23.0 \
    --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
    --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \

zipp==3.21.0 \
    --hash=sha256:2c9958f6430a2040341a52eb608ed6dd93ef4392e02ffe219417c1b28b5dd1f4 \
    --hash=sha256:ac1bbe05fd2991f160ebce24ffbac5f6d11d83dc90891255885223d42b3cd931
    # via importlib-metadata
zstandard==0.23.0 \
    --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
    --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \

    --hash=sha256:ffa565331890b90056c01db69c0fe634a776f8019c143a5ae265f9c6bc4bd6d4
    # via -r ci/official/requirements_updater/requirements.in
zstandard==0.23.0 \
    --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
    --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \

    `TlsVersion.SSL_3_0`.

 *  New: Upgrade to Okio 1.13.0.

     ```xml
     <dependency>
       <groupId>com.squareup.okio</groupId>
       <artifactId>okio</artifactId>
       <version>1.13.0</version>
     </dependency>

     com.squareup.okio:okio:1.13.0
     ```

 *  Fix: gracefully recover when Android 7.0's sockets throw an unexpected

        .scheme("http")
        .build()
        .port,
    ).isEqualTo(80)
    assertThat(
      parse("https://example.com:1234")
        .newBuilder()
        .scheme("http")
        .build()
        .port,
    ).isEqualTo(1234)
  }

  @Test
  fun composeEncodesWhitespace() {
    val url =
      HttpUrl
        .Builder()
        .scheme("http")

http://foo/abcd?efgh?ijkl  s:http h:foo p:/abcd q:?efgh?ijkl
http://foo/abcd#foo?bar  s:http h:foo p:/abcd f:#foo?bar
[61:24:74]:98  s:http h:example.org p:/foo/[61:24:74]:98
http:[61:27]/:foo  s:http h:example.org p:/foo/[61:27]/:foo
http://[1::2]:3:4
http://2001::1
http://2001::1]
http://2001::1]:80
http://[2001::1]  s:http h:[2001::1] p:/
http://[2001::1]:80  s:http h:[2001::1] p:/
http:/example.com/  s:http h:example.org p:/example.com/