},
		{
			name: "cidr",
			in:   "1.2.3.0/24",
			err:  "must be a valid IP address",
		},
		{
			name: "ipv4 with out-of-range octets",
			in:   "1.2.3.400",
			err:  "must be a valid IP address",
		},
		{
			name: "ipv4 with negative octets",
			in:   "-1.0.0.0",
			err:  "must be a valid IP address",
		},
		{
			name: "ipv6 with out-of-range segment",
			in:   "2001:db8::10005",

		}
	}
	return allErrors
}

// Allowed characters in an HTTP Path as defined by RFC 3986. A HTTP path may
// contain:
// * unreserved characters (alphanumeric, '-', '.', '_', '~')
// * percent-encoded octets
// * sub-delims ("!", "$", "&", "'", "(", ")", "*", "+", ",", ";", "=")
// * a colon character (":")
const httpPathFmt string = `[A-Za-z0-9/\-._~%!$&'()*+,;=:]+`

	// Per X690 Section 11.6: The encodings of the component values of a
	// set-of value shall appear in ascending order, the encodings being
	// compared as octet strings with the shorter components being padded
	// at their trailing end with 0-octets.
	//
	// First we encode each element to its TLV encoding and then use
	// octetSort to get the ordering expected by X690 DER rules before

	// so this condition would trigger anyway).
	if len(serialBytes) > 20+2 {
		if x509seriallength.Value() != "1" {
			return nil, errors.New("x509: serial number too long (>20 octets)")
		} else {
			x509seriallength.IncNonDefault()
		}
	}
	serial := new(big.Int)
	if !serialBytes.ReadASN1Integer(serial) {
		return nil, errors.New("x509: malformed serial number")
	}

the [`x509negativeserial` setting](/pkg/crypto/x509/#ParseCertificate).

Go 1.23 changed the behavior of
[crypto/x509.ParseCertificate](/pkg/crypto/x509/#ParseCertificate) to reject
serial numbers that are longer than 20 octets. This change can be reverted with
the [`x509seriallength` setting](/pkg/crypto/x509/#ParseCertificate).

Go 1.23 re-enabled support in html/template for ECMAScript 6 template literals by default.

		{"foo\\bar", false, "foobar"},
		{"foo\"bar", false, "foobar"},
		{"\x00\x7e\x7f\x80", false, "\x7e"},
		{`withquotes`, true, `"withquotes"`},
		{`"withquotes"`, true, `"withquotes"`}, // double quotes are not valid octets
		{"a z", false, `"a z"`},
		{" z", false, `" z"`},
		{"a ", false, `"a "`},
		{"a,z", false, `"a,z"`},
		{",z", false, `",z"`},
		{"a,", false, `"a,"`},
	}
	for _, tt := range tests {

	if template.SerialNumber == nil {
		return nil, errors.New("x509: no SerialNumber given")
	}

	// RFC 5280 Section 4.1.2.2: serial number must positive
	//
	// We _should_ also restrict serials to <= 20 octets, but it turns out a lot of people
	// get this wrong, in part because the encoding can itself alter the length of the
	// serial. For now we accept these non-conformant serials.
	if template.SerialNumber.Sign() == -1 {

labels.search_result_sort_favorite_count_asc	=	Favori (croissant)
labels.search_result_sort_favorite_count_desc	=	Favori (décroissant)
labels.search_result_sort_multiple	=	Plusieurs
labels.search_result_size	=	{0} octets
labels.search_result_created	=	Inscrit:
labels.search_result_last_modified	=	Dernière modification :
labels.search_result_favorite	=	Aime
labels.search_result_favorited	=	Aimé
labels.search_click_count	=	Vu ({0})

				NextUpdate: time.Time{}.Add(time.Hour * 48),
				Number:     big.NewInt(0).SetBytes(append([]byte{1}, make([]byte, 20)...)),
			},
			expectedError: "x509: CRL number exceeds 20 octets",
		},
		{
			name: "long Number (20 bytes, MSB set)",
			key:  ec256Priv,
			issuer: &Certificate{
				KeyUsage: KeyUsageCRLSign,
				Subject: pkix.Name{
					CommonName: "testing",
				},

// associated with a stream.
// See https://httpwg.org/specs/rfc7540.html#rfc.section.6.1
type http2DataFrame struct {
	http2FrameHeader
	data []byte
}

func (f *http2DataFrame) StreamEnded() bool {
	return f.http2FrameHeader.Flags.Has(http2FlagDataEndStream)
}

// Data returns the frame's data octets, not including any padding