diff -pruN 1.18.4-1/debian/changelog 1.18.5-1/debian/changelog
--- 1.18.4-1/debian/changelog	2022-07-13 00:08:18.000000000 +0000
+++ 1.18.5-1/debian/changelog	2022-08-06 10:56:18.000000000 +0000
@@ -1,3 +1,23 @@
+golang-1.18 (1.18.5-1) unstable; urgency=medium
+
+  * New upstream version 1.18.5
+    + CVE-2022-32189: math/big: index out of range in Float.GobDecode
+    + cmd/go: Build information embedded by Go 1.18 impairs build
+      reproducibility with cgo flags (Closes: #1008114)
+  * Remove 0005-cmd-compile-revert-fix-missing-dict-pass-for-type-as.patch
+    which has been applied upstream in v1.18.5
+  * Bump Standards-Version to 4.6.1 (no change)
+
+ -- Anthony Fok <foka@debian.org>  Sat, 06 Aug 2022 04:56:18 -0600
+
+golang-1.18 (1.18.4-2) unstable; urgency=medium
+
+  * Team upload.
+  * cmd/compile: revert "fix missing dict pass for type assertions"
+    Backport patch from https://go.dev/cl/417615 (Closes: #1015088)
+
+ -- Shengjing Zhu <zhsj@debian.org>  Tue, 26 Jul 2022 10:58:55 +0800
+
 golang-1.18 (1.18.4-1) unstable; urgency=medium
 
   * New upstream version 1.18.4
diff -pruN 1.18.4-1/debian/control 1.18.5-1/debian/control
--- 1.18.4-1/debian/control	2022-07-13 00:08:18.000000000 +0000
+++ 1.18.5-1/debian/control	2022-08-06 10:45:55.000000000 +0000
@@ -15,7 +15,7 @@ Priority: optional
 Build-Depends: debhelper-compat (= 13),
                golang-any (>= 2:1.4~) | golang-go (>= 2:1.4~) | gccgo (>= 4:5~),
                netbase
-Standards-Version: 4.6.0
+Standards-Version: 4.6.1
 Vcs-Browser: https://salsa.debian.org/go-team/compiler/golang/tree/golang-1.18
 Vcs-Git: https://salsa.debian.org/go-team/compiler/golang.git -b golang-1.18
 Homepage: https://go.dev/
diff -pruN 1.18.4-1/debian/control.in 1.18.5-1/debian/control.in
--- 1.18.4-1/debian/control.in	2022-07-13 00:08:18.000000000 +0000
+++ 1.18.5-1/debian/control.in	2022-08-06 10:46:00.000000000 +0000
@@ -11,7 +11,7 @@ Priority: optional
 Build-Depends: debhelper-compat (= 13),
                golang-any (>= 2:1.4~) | golang-go (>= 2:1.4~) | gccgo (>= 4:5~),
                netbase
-Standards-Version: 4.6.0
+Standards-Version: 4.6.1
 Vcs-Browser: https://salsa.debian.org/go-team/compiler/golang/tree/golang-X.Y
 Vcs-Git: https://salsa.debian.org/go-team/compiler/golang.git -b golang-X.Y
 Homepage: https://go.dev/
diff -pruN 1.18.4-1/debian/patches/0001-Disable-test-for-UserHomeDir.patch 1.18.5-1/debian/patches/0001-Disable-test-for-UserHomeDir.patch
--- 1.18.4-1/debian/patches/0001-Disable-test-for-UserHomeDir.patch	2022-03-15 20:12:45.000000000 +0000
+++ 1.18.5-1/debian/patches/0001-Disable-test-for-UserHomeDir.patch	2022-08-06 10:52:08.000000000 +0000
@@ -7,9 +7,11 @@ On Debian buildds, the user home dir doe
  src/os/os_test.go | 2 ++
  1 file changed, 2 insertions(+)
 
+diff --git a/src/os/os_test.go b/src/os/os_test.go
+index 63427de..1695375 100644
 --- a/src/os/os_test.go
 +++ b/src/os/os_test.go
-@@ -2540,6 +2540,8 @@
+@@ -2534,6 +2534,8 @@ func TestUserHomeDir(t *testing.T) {
  	if err != nil {
  		t.Skipf("UserHomeDir failed: %v", err)
  	}
diff -pruN 1.18.4-1/debian/patches/0002-Fix-Lintian-warnings-about-wrong-interpreter-path.patch 1.18.5-1/debian/patches/0002-Fix-Lintian-warnings-about-wrong-interpreter-path.patch
--- 1.18.4-1/debian/patches/0002-Fix-Lintian-warnings-about-wrong-interpreter-path.patch	2022-03-15 20:12:45.000000000 +0000
+++ 1.18.5-1/debian/patches/0002-Fix-Lintian-warnings-about-wrong-interpreter-path.patch	2022-08-06 10:52:08.000000000 +0000
@@ -9,14 +9,15 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  src/syscall/mksyscall.pl          | 2 +-
  src/syscall/mksyscall_libc.pl     | 2 +-
  src/syscall/mksysctl_openbsd.pl   | 2 +-
- src/syscall/mksysnum_darwin.pl    | 2 +-
  src/syscall/mksysnum_dragonfly.pl | 2 +-
  src/syscall/mksysnum_freebsd.pl   | 2 +-
  src/syscall/mksysnum_linux.pl     | 2 +-
  src/syscall/mksysnum_netbsd.pl    | 2 +-
  src/syscall/mksysnum_openbsd.pl   | 2 +-
- 9 files changed, 9 insertions(+), 9 deletions(-)
+ 8 files changed, 8 insertions(+), 8 deletions(-)
 
+diff --git a/src/syscall/mksyscall.pl b/src/syscall/mksyscall.pl
+index 25ab911..98de8e8 100755
 --- a/src/syscall/mksyscall.pl
 +++ b/src/syscall/mksyscall.pl
 @@ -1,4 +1,4 @@
@@ -25,6 +26,8 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  # Copyright 2009 The Go Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style
  # license that can be found in the LICENSE file.
+diff --git a/src/syscall/mksyscall_libc.pl b/src/syscall/mksyscall_libc.pl
+index 3731476..47457a1 100755
 --- a/src/syscall/mksyscall_libc.pl
 +++ b/src/syscall/mksyscall_libc.pl
 @@ -1,4 +1,4 @@
@@ -33,6 +36,8 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  # Copyright 2009 The Go Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style
  # license that can be found in the LICENSE file.
+diff --git a/src/syscall/mksysctl_openbsd.pl b/src/syscall/mksysctl_openbsd.pl
+index ea462a7..7e8a3e2 100755
 --- a/src/syscall/mksysctl_openbsd.pl
 +++ b/src/syscall/mksysctl_openbsd.pl
 @@ -1,4 +1,4 @@
@@ -41,6 +46,8 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  
  # Copyright 2011 The Go Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style
+diff --git a/src/syscall/mksysnum_dragonfly.pl b/src/syscall/mksysnum_dragonfly.pl
+index e9a634b..a8df18d 100755
 --- a/src/syscall/mksysnum_dragonfly.pl
 +++ b/src/syscall/mksysnum_dragonfly.pl
 @@ -1,4 +1,4 @@
@@ -49,6 +56,8 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  # Copyright 2009 The Go Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style
  # license that can be found in the LICENSE file.
+diff --git a/src/syscall/mksysnum_freebsd.pl b/src/syscall/mksysnum_freebsd.pl
+index c04ada9..f9b7b91 100755
 --- a/src/syscall/mksysnum_freebsd.pl
 +++ b/src/syscall/mksysnum_freebsd.pl
 @@ -1,4 +1,4 @@
@@ -57,6 +66,8 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  # Copyright 2009 The Go Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style
  # license that can be found in the LICENSE file.
+diff --git a/src/syscall/mksysnum_linux.pl b/src/syscall/mksysnum_linux.pl
+index 5fb1d0e..ebeb9a8 100755
 --- a/src/syscall/mksysnum_linux.pl
 +++ b/src/syscall/mksysnum_linux.pl
 @@ -1,4 +1,4 @@
@@ -65,6 +76,8 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  # Copyright 2009 The Go Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style
  # license that can be found in the LICENSE file.
+diff --git a/src/syscall/mksysnum_netbsd.pl b/src/syscall/mksysnum_netbsd.pl
+index 4f5150a..53783ff 100755
 --- a/src/syscall/mksysnum_netbsd.pl
 +++ b/src/syscall/mksysnum_netbsd.pl
 @@ -1,4 +1,4 @@
@@ -73,6 +86,8 @@ grep -rH "/usr/bin/env perl" * | cut -d:
  # Copyright 2009 The Go Authors. All rights reserved.
  # Use of this source code is governed by a BSD-style
  # license that can be found in the LICENSE file.
+diff --git a/src/syscall/mksysnum_openbsd.pl b/src/syscall/mksysnum_openbsd.pl
+index f8f484b..312486d 100755
 --- a/src/syscall/mksysnum_openbsd.pl
 +++ b/src/syscall/mksysnum_openbsd.pl
 @@ -1,4 +1,4 @@
diff -pruN 1.18.4-1/debian/patches/0003-cmd-dist-increase-default-timeout-scale-for-arm.patch 1.18.5-1/debian/patches/0003-cmd-dist-increase-default-timeout-scale-for-arm.patch
--- 1.18.4-1/debian/patches/0003-cmd-dist-increase-default-timeout-scale-for-arm.patch	1970-01-01 00:00:00.000000000 +0000
+++ 1.18.5-1/debian/patches/0003-cmd-dist-increase-default-timeout-scale-for-arm.patch	2022-08-06 10:52:08.000000000 +0000
@@ -0,0 +1,29 @@
+From: Balint Reczey <balint.reczey@canonical.com>
+Date: Mon, 31 Aug 2020 13:14:51 +0200
+Subject: [PATCH] cmd/dist: increase default timeout scale for arm
+
+Forwarded: https://github.com/golang/go/issues/43002
+
+Most developers use (faster) amd64 machines setting the test timeouts,
+but test may run on slower arm ones and also different tests may suffer
+different relative slowdown on the arm CPUs.
+
+Due to those two varying factors it is safer to allow a higher timeout
+scale on arm to avoid tests timing out.
+---
+ src/cmd/dist/test.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
+index d9eb9c3..c82d746 100644
+--- a/src/cmd/dist/test.go
++++ b/src/cmd/dist/test.go
+@@ -173,7 +173,7 @@ func (t *tester) run() {
+ 	t.timeoutScale = 1
+ 	switch goarch {
+ 	case "arm":
+-		t.timeoutScale = 2
++		t.timeoutScale = 3
+ 	case "mips", "mipsle", "mips64", "mips64le":
+ 		t.timeoutScale = 4
+ 	}
diff -pruN 1.18.4-1/debian/patches/0004-skip-userns-test-in-schroot-as-well.patch 1.18.5-1/debian/patches/0004-skip-userns-test-in-schroot-as-well.patch
--- 1.18.4-1/debian/patches/0004-skip-userns-test-in-schroot-as-well.patch	1970-01-01 00:00:00.000000000 +0000
+++ 1.18.5-1/debian/patches/0004-skip-userns-test-in-schroot-as-well.patch	2022-08-06 10:52:08.000000000 +0000
@@ -0,0 +1,34 @@
+From: Shengjing Zhu <zhsj@debian.org>
+Date: Fri, 5 Feb 2021 21:21:45 +0800
+Subject: skip userns test in schroot as well
+
+When schroot is using overlayfs, it fails to detect it as chroot.
+---
+ src/syscall/exec_linux_test.go | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/syscall/exec_linux_test.go b/src/syscall/exec_linux_test.go
+index 0ec9c4d..cabaaf9 100644
+--- a/src/syscall/exec_linux_test.go
++++ b/src/syscall/exec_linux_test.go
+@@ -32,6 +32,10 @@ func isLXC() bool {
+ 	return os.Getenv("container") == "lxc"
+ }
+ 
++func isSchroot() bool {
++	return os.Getenv("SCHROOT_SESSION_ID") != ""
++}
++
+ func skipInContainer(t *testing.T) {
+ 	// TODO: the callers of this func are using this func to skip
+ 	// tests when running as some sort of "fake root" that's uid 0
+@@ -47,6 +51,9 @@ func skipInContainer(t *testing.T) {
+ 	if isLXC() {
+ 		t.Skip("skip this test in LXC container")
+ 	}
++	if isSchroot() {
++		t.Skip("skip this test in Schroot container")
++	}
+ }
+ 
+ func skipNoUserNamespaces(t *testing.T) {
diff -pruN 1.18.4-1/debian/patches/0005-cmd-dist-increase-default-timeout-scale-for-arm.patch 1.18.5-1/debian/patches/0005-cmd-dist-increase-default-timeout-scale-for-arm.patch
--- 1.18.4-1/debian/patches/0005-cmd-dist-increase-default-timeout-scale-for-arm.patch	2022-03-15 20:12:45.000000000 +0000
+++ 1.18.5-1/debian/patches/0005-cmd-dist-increase-default-timeout-scale-for-arm.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,27 +0,0 @@
-From: Balint Reczey <balint.reczey@canonical.com>
-Date: Mon, 31 Aug 2020 13:14:51 +0200
-Subject: [PATCH] cmd/dist: increase default timeout scale for arm
-
-Forwarded: https://github.com/golang/go/issues/43002
-
-Most developers use (faster) amd64 machines setting the test timeouts,
-but test may run on slower arm ones and also different tests may suffer
-different relative slowdown on the arm CPUs.
-
-Due to those two varying factors it is safer to allow a higher timeout
-scale on arm to avoid tests timing out.
----
- src/cmd/dist/test.go | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/src/cmd/dist/test.go
-+++ b/src/cmd/dist/test.go
-@@ -165,7 +165,7 @@
- 	t.timeoutScale = 1
- 	switch goarch {
- 	case "arm":
--		t.timeoutScale = 2
-+		t.timeoutScale = 3
- 	case "mips", "mipsle", "mips64", "mips64le":
- 		t.timeoutScale = 4
- 	}
diff -pruN 1.18.4-1/debian/patches/0006-skip-userns-test-in-schroot-as-well.patch 1.18.5-1/debian/patches/0006-skip-userns-test-in-schroot-as-well.patch
--- 1.18.4-1/debian/patches/0006-skip-userns-test-in-schroot-as-well.patch	2022-03-15 20:12:45.000000000 +0000
+++ 1.18.5-1/debian/patches/0006-skip-userns-test-in-schroot-as-well.patch	1970-01-01 00:00:00.000000000 +0000
@@ -1,33 +0,0 @@
-From: Shengjing Zhu <zhsj@debian.org>
-Date: Fri, 5 Feb 2021 21:21:45 +0800
-Subject: skip userns test in schroot as well
-
-When schroot is using overlayfs, it fails to detect it as chroot.
-
----
- src/syscall/exec_linux_test.go | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/src/syscall/exec_linux_test.go
-+++ b/src/syscall/exec_linux_test.go
-@@ -33,6 +33,10 @@
- 	return os.Getenv("container") == "lxc"
- }
- 
-+func isSchroot() bool {
-+	return os.Getenv("SCHROOT_SESSION_ID") != ""
-+}
-+
- func skipInContainer(t *testing.T) {
- 	// TODO: the callers of this func are using this func to skip
- 	// tests when running as some sort of "fake root" that's uid 0
-@@ -48,6 +52,9 @@
- 	if isLXC() {
- 		t.Skip("skip this test in LXC container")
- 	}
-+	if isSchroot() {
-+		t.Skip("skip this test in Schroot container")
-+	}
- }
- 
- func skipNoUserNamespaces(t *testing.T) {
diff -pruN 1.18.4-1/debian/patches/series 1.18.5-1/debian/patches/series
--- 1.18.4-1/debian/patches/series	2022-06-13 21:17:43.000000000 +0000
+++ 1.18.5-1/debian/patches/series	2022-08-06 10:53:55.000000000 +0000
@@ -1,4 +1,4 @@
 0001-Disable-test-for-UserHomeDir.patch
 0002-Fix-Lintian-warnings-about-wrong-interpreter-path.patch
-0005-cmd-dist-increase-default-timeout-scale-for-arm.patch
-0006-skip-userns-test-in-schroot-as-well.patch
+0003-cmd-dist-increase-default-timeout-scale-for-arm.patch
+0004-skip-userns-test-in-schroot-as-well.patch
diff -pruN 1.18.4-1/src/cmd/compile/internal/noder/stencil.go 1.18.5-1/src/cmd/compile/internal/noder/stencil.go
--- 1.18.4-1/src/cmd/compile/internal/noder/stencil.go	2022-07-12 15:22:53.000000000 +0000
+++ 1.18.5-1/src/cmd/compile/internal/noder/stencil.go	2022-07-29 16:11:05.000000000 +0000
@@ -1297,10 +1297,10 @@ func (g *genInst) dictPass(info *instInf
 				m = convertUsingDictionary(info, info.dictParam, m.Pos(), mce.X, m, m.Type(), false)
 			}
 		case ir.ODOTTYPE, ir.ODOTTYPE2:
-			dt := m.(*ir.TypeAssertExpr)
-			if !dt.Type().HasShape() && !dt.X.Type().HasShape() {
+			if !m.Type().HasShape() {
 				break
 			}
+			dt := m.(*ir.TypeAssertExpr)
 			var rt ir.Node
 			if dt.Type().IsInterface() || dt.X.Type().IsEmptyInterface() {
 				ix := findDictType(info, m.Type())
diff -pruN 1.18.4-1/src/cmd/compile/internal/typecheck/stmt.go 1.18.5-1/src/cmd/compile/internal/typecheck/stmt.go
--- 1.18.4-1/src/cmd/compile/internal/typecheck/stmt.go	2022-07-12 15:22:53.000000000 +0000
+++ 1.18.5-1/src/cmd/compile/internal/typecheck/stmt.go	2022-07-29 16:11:05.000000000 +0000
@@ -127,23 +127,13 @@ func assign(stmt ir.Node, lhs, rhs []ir.
 
 	checkLHS := func(i int, typ *types.Type) {
 		lhs[i] = Resolve(lhs[i])
-		if base.Flag.G != 0 || base.Debug.Unified != 0 {
-			// New logic added in CL 403837 for Go 1.19, which only has -G=3 and unified IR.
-			if n := lhs[i]; typ != nil && ir.DeclaredBy(n, stmt) && n.Type() == nil {
-				base.Assertf(typ.Kind() == types.TNIL, "unexpected untyped nil")
+		if n := lhs[i]; typ != nil && ir.DeclaredBy(n, stmt) && n.Name().Ntype == nil {
+			if typ.Kind() != types.TNIL {
 				n.SetType(defaultType(typ))
-			}
-		} else {
-			// Original logic from Go 1.18, which is still needed for -G=0.
-			if n := lhs[i]; typ != nil && ir.DeclaredBy(n, stmt) && n.Name().Ntype == nil {
-				if typ.Kind() != types.TNIL {
-					n.SetType(defaultType(typ))
-				} else {
-					base.Errorf("use of untyped nil")
-				}
+			} else {
+				base.Errorf("use of untyped nil")
 			}
 		}
-
 		if lhs[i].Typecheck() == 0 {
 			lhs[i] = AssignExpr(lhs[i])
 		}
diff -pruN 1.18.4-1/src/cmd/compile/internal/walk/complit.go 1.18.5-1/src/cmd/compile/internal/walk/complit.go
--- 1.18.4-1/src/cmd/compile/internal/walk/complit.go	2022-07-12 15:22:54.000000000 +0000
+++ 1.18.5-1/src/cmd/compile/internal/walk/complit.go	2022-07-29 16:11:05.000000000 +0000
@@ -621,6 +621,12 @@ func oaslit(n *ir.AssignStmt, init *ir.N
 		// not a special composite literal assignment
 		return false
 	}
+	if x.Addrtaken() {
+		// If x is address-taken, the RHS may (implicitly) uses LHS.
+		// Not safe to do a special composite literal assignment
+		// (which may expand to multiple assignments).
+		return false
+	}
 
 	switch n.Y.Op() {
 	default:
@@ -629,7 +635,7 @@ func oaslit(n *ir.AssignStmt, init *ir.N
 
 	case ir.OSTRUCTLIT, ir.OARRAYLIT, ir.OSLICELIT, ir.OMAPLIT:
 		if ir.Any(n.Y, func(y ir.Node) bool { return ir.Uses(y, x) }) {
-			// not a special composite literal assignment
+			// not safe to do a special composite literal assignment if RHS uses LHS.
 			return false
 		}
 		anylit(n.Y, n.X, init)
diff -pruN 1.18.4-1/src/cmd/go/internal/load/pkg.go 1.18.5-1/src/cmd/go/internal/load/pkg.go
--- 1.18.4-1/src/cmd/go/internal/load/pkg.go	2022-07-12 15:22:54.000000000 +0000
+++ 1.18.5-1/src/cmd/go/internal/load/pkg.go	2022-07-29 16:11:05.000000000 +0000
@@ -2329,7 +2329,17 @@ func (p *Package) setBuildInfo(includeVC
 			appendSetting("-gcflags", BuildGcflags.String())
 		}
 		if BuildLdflags.present {
-			appendSetting("-ldflags", BuildLdflags.String())
+			// https://go.dev/issue/52372: only include ldflags if -trimpath is not set,
+			// since it can include system paths through various linker flags (notably
+			// -extar, -extld, and -extldflags).
+			//
+			// TODO: since we control cmd/link, in theory we can parse ldflags to
+			// determine whether they may refer to system paths. If we do that, we can
+			// redact only those paths from the recorded -ldflags setting and still
+			// record the system-independent parts of the flags.
+			if !cfg.BuildTrimpath {
+				appendSetting("-ldflags", BuildLdflags.String())
+			}
 		}
 		if cfg.BuildMSan {
 			appendSetting("-msan", "true")
@@ -2345,7 +2355,14 @@ func (p *Package) setBuildInfo(includeVC
 			cgo = "1"
 		}
 		appendSetting("CGO_ENABLED", cgo)
-		if cfg.BuildContext.CgoEnabled {
+		// https://go.dev/issue/52372: only include CGO flags if -trimpath is not set.
+		// (If -trimpath is set, it is possible that these flags include system paths.)
+		// If cgo is involved, reproducibility is already pretty well ruined anyway,
+		// given that we aren't stamping header or library versions.
+		//
+		// TODO(bcmills): perhaps we could at least parse the flags and stamp the
+		// subset of flags that are known not to be paths?
+		if cfg.BuildContext.CgoEnabled && !cfg.BuildTrimpath {
 			for _, name := range []string{"CGO_CFLAGS", "CGO_CPPFLAGS", "CGO_CXXFLAGS", "CGO_LDFLAGS"} {
 				appendSetting(name, cfg.Getenv(name))
 			}
diff -pruN 1.18.4-1/src/cmd/go/internal/modload/buildlist.go 1.18.5-1/src/cmd/go/internal/modload/buildlist.go
--- 1.18.4-1/src/cmd/go/internal/modload/buildlist.go	2022-07-12 15:22:54.000000000 +0000
+++ 1.18.5-1/src/cmd/go/internal/modload/buildlist.go	2022-07-29 16:11:05.000000000 +0000
@@ -397,7 +397,6 @@ func readModGraph(ctx context.Context, p
 		seen := map[module.Version]bool{}
 		for _, m := range roots {
 			hasDepsInAll[m.Path] = true
-			seen[m] = true
 		}
 		// This loop will terminate because it will call enqueue on each version of
 		// each dependency of the modules in hasDepsInAll at most once (and only
@@ -406,11 +405,11 @@ func readModGraph(ctx context.Context, p
 			needsEnqueueing := map[module.Version]bool{}
 			for p := range hasDepsInAll {
 				m := module.Version{Path: p, Version: mg.g.Selected(p)}
-				reqs, ok := mg.g.RequiredBy(m)
-				if !ok {
+				if !seen[m] {
 					needsEnqueueing[m] = true
 					continue
 				}
+				reqs, _ := mg.g.RequiredBy(m)
 				for _, r := range reqs {
 					s := module.Version{Path: r.Path, Version: mg.g.Selected(r.Path)}
 					if cmpVersion(s.Version, r.Version) > 0 && !seen[s] {
diff -pruN 1.18.4-1/src/cmd/go/testdata/script/version_build_settings.txt 1.18.5-1/src/cmd/go/testdata/script/version_build_settings.txt
--- 1.18.4-1/src/cmd/go/testdata/script/version_build_settings.txt	2022-07-12 15:22:54.000000000 +0000
+++ 1.18.5-1/src/cmd/go/testdata/script/version_build_settings.txt	2022-07-29 16:11:05.000000000 +0000
@@ -47,19 +47,34 @@ go build
 go version -m m$GOEXE
 stdout '^\tbuild\tCGO_ENABLED=0$'
 ! stdout CGO_CPPFLAGS|CGO_CFLAGS|CGO_CXXFLAGS|CGO_LDFLAGS
+
 [cgo] env CGO_ENABLED=1
 [cgo] env CGO_CPPFLAGS=-DFROM_CPPFLAGS=1
 [cgo] env CGO_CFLAGS=-DFROM_CFLAGS=1
 [cgo] env CGO_CXXFLAGS=-DFROM_CXXFLAGS=1
 [cgo] env CGO_LDFLAGS=-L/extra/dir/does/not/exist
-[cgo] go build
+[cgo] go build '-ldflags=all=-linkmode=external -extldflags=-L/bonus/dir/does/not/exist'
 [cgo] go version -m m$GOEXE
+[cgo] stdout '^\tbuild\t-ldflags="all=-linkmode=external -extldflags=-L/bonus/dir/does/not/exist"$'
 [cgo] stdout '^\tbuild\tCGO_ENABLED=1$'
 [cgo] stdout '^\tbuild\tCGO_CPPFLAGS=-DFROM_CPPFLAGS=1$'
 [cgo] stdout '^\tbuild\tCGO_CFLAGS=-DFROM_CFLAGS=1$'
 [cgo] stdout '^\tbuild\tCGO_CXXFLAGS=-DFROM_CXXFLAGS=1$'
 [cgo] stdout '^\tbuild\tCGO_LDFLAGS=-L/extra/dir/does/not/exist$'
 
+# https://go.dev/issue/52372: a cgo-enabled binary should not be stamped with
+# CGO_ flags that contain paths.
+[cgo] env CGO_ENABLED=1
+[cgo] env CGO_CPPFLAGS=-DFROM_CPPFLAGS=1
+[cgo] env CGO_CFLAGS=-DFROM_CFLAGS=1
+[cgo] env CGO_CXXFLAGS=-DFROM_CXXFLAGS=1
+[cgo] env CGO_LDFLAGS=-L/extra/dir/does/not/exist
+[cgo] go build -trimpath '-ldflags=all=-linkmode=external -extldflags=-L/bonus/dir/does/not/exist'
+[cgo] go version -m m$GOEXE
+[cgo] ! stdout '/extra/dir/does/not/exist'
+[cgo] ! stdout '/bonus/dir/does/not/exist'
+[cgo] stdout '^\tbuild\tCGO_ENABLED=1$'
+
 -- go.mod --
 module example.com/m
 
diff -pruN 1.18.4-1/src/cmd/go/testdata/script/work_goproxy_off.txt 1.18.5-1/src/cmd/go/testdata/script/work_goproxy_off.txt
--- 1.18.4-1/src/cmd/go/testdata/script/work_goproxy_off.txt	1970-01-01 00:00:00.000000000 +0000
+++ 1.18.5-1/src/cmd/go/testdata/script/work_goproxy_off.txt	2022-07-29 16:11:05.000000000 +0000
@@ -0,0 +1,59 @@
+go work init
+go work use . ./sub
+
+# Verify that the go.mod files for both modules in the workspace are tidy,
+# and add missing go.sum entries as needed.
+
+cp go.mod go.mod.orig
+go mod tidy
+cmp go.mod go.mod.orig
+
+cd sub
+cp go.mod go.mod.orig
+go mod tidy
+cmp go.mod go.mod.orig
+cd ..
+
+go list -m all
+stdout '^rsc\.io/quote v1\.5\.1$'
+stdout '^rsc\.io/sampler v1\.3\.1$'
+
+# Now remove the module dependencies from the module cache.
+# Because one module upgrades a transitive dependency needed by another,
+# listing the modules in the workspace should error out.
+
+go clean -modcache
+env GOPROXY=off
+! go list -m all
+stderr '^go: rsc.io/sampler@v1.3.0: module lookup disabled by GOPROXY=off$'
+
+-- example.go --
+package example
+
+import _ "rsc.io/sampler"
+-- go.mod --
+module example
+
+go 1.18
+
+require rsc.io/sampler v1.3.0
+
+require (
+	golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c // indirect
+	rsc.io/testonly v1.0.0 // indirect
+)
+-- sub/go.mod --
+module example/sub
+
+go 1.18
+
+require rsc.io/quote v1.5.1
+
+require (
+	golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c // indirect
+	rsc.io/sampler v1.3.1 // indirect
+)
+-- sub/sub.go --
+package example
+
+import _ "rsc.io/quote"
diff -pruN 1.18.4-1/src/math/big/floatmarsh.go 1.18.5-1/src/math/big/floatmarsh.go
--- 1.18.4-1/src/math/big/floatmarsh.go	2022-07-12 15:22:56.000000000 +0000
+++ 1.18.5-1/src/math/big/floatmarsh.go	2022-07-29 16:11:07.000000000 +0000
@@ -8,6 +8,7 @@ package big
 
 import (
 	"encoding/binary"
+	"errors"
 	"fmt"
 )
 
@@ -67,6 +68,9 @@ func (z *Float) GobDecode(buf []byte) er
 		*z = Float{}
 		return nil
 	}
+	if len(buf) < 6 {
+		return errors.New("Float.GobDecode: buffer too small")
+	}
 
 	if buf[0] != floatGobVersion {
 		return fmt.Errorf("Float.GobDecode: encoding version %d not supported", buf[0])
@@ -83,6 +87,9 @@ func (z *Float) GobDecode(buf []byte) er
 	z.prec = binary.BigEndian.Uint32(buf[2:])
 
 	if z.form == finite {
+		if len(buf) < 10 {
+			return errors.New("Float.GobDecode: buffer too small for finite form float")
+		}
 		z.exp = int32(binary.BigEndian.Uint32(buf[6:]))
 		z.mant = z.mant.setBytes(buf[10:])
 	}
diff -pruN 1.18.4-1/src/math/big/floatmarsh_test.go 1.18.5-1/src/math/big/floatmarsh_test.go
--- 1.18.4-1/src/math/big/floatmarsh_test.go	2022-07-12 15:22:56.000000000 +0000
+++ 1.18.5-1/src/math/big/floatmarsh_test.go	2022-07-29 16:11:07.000000000 +0000
@@ -137,3 +137,15 @@ func TestFloatJSONEncoding(t *testing.T)
 		}
 	}
 }
+
+func TestFloatGobDecodeShortBuffer(t *testing.T) {
+	for _, tc := range [][]byte{
+		[]byte{0x1, 0x0, 0x0, 0x0},
+		[]byte{0x1, 0xfa, 0x0, 0x0, 0x0, 0x0},
+	} {
+		err := NewFloat(0).GobDecode(tc)
+		if err == nil {
+			t.Error("expected GobDecode to return error for malformed input")
+		}
+	}
+}
diff -pruN 1.18.4-1/src/math/big/ratmarsh.go 1.18.5-1/src/math/big/ratmarsh.go
--- 1.18.4-1/src/math/big/ratmarsh.go	2022-07-12 15:22:56.000000000 +0000
+++ 1.18.5-1/src/math/big/ratmarsh.go	2022-07-29 16:11:08.000000000 +0000
@@ -45,12 +45,18 @@ func (z *Rat) GobDecode(buf []byte) erro
 		*z = Rat{}
 		return nil
 	}
+	if len(buf) < 5 {
+		return errors.New("Rat.GobDecode: buffer too small")
+	}
 	b := buf[0]
 	if b>>1 != ratGobVersion {
 		return fmt.Errorf("Rat.GobDecode: encoding version %d not supported", b>>1)
 	}
 	const j = 1 + 4
 	i := j + binary.BigEndian.Uint32(buf[j-4:j])
+	if len(buf) < int(i) {
+		return errors.New("Rat.GobDecode: buffer too small")
+	}
 	z.a.neg = b&1 != 0
 	z.a.abs = z.a.abs.setBytes(buf[j:i])
 	z.b.abs = z.b.abs.setBytes(buf[i:])
diff -pruN 1.18.4-1/src/math/big/ratmarsh_test.go 1.18.5-1/src/math/big/ratmarsh_test.go
--- 1.18.4-1/src/math/big/ratmarsh_test.go	2022-07-12 15:22:56.000000000 +0000
+++ 1.18.5-1/src/math/big/ratmarsh_test.go	2022-07-29 16:11:08.000000000 +0000
@@ -123,3 +123,15 @@ func TestRatXMLEncoding(t *testing.T) {
 		}
 	}
 }
+
+func TestRatGobDecodeShortBuffer(t *testing.T) {
+	for _, tc := range [][]byte{
+		[]byte{0x2},
+		[]byte{0x2, 0x0, 0x0, 0x0, 0xff},
+	} {
+		err := NewRat(1, 2).GobDecode(tc)
+		if err == nil {
+			t.Error("expected GobDecode to return error for malformed input")
+		}
+	}
+}
diff -pruN 1.18.4-1/src/runtime/time.go 1.18.5-1/src/runtime/time.go
--- 1.18.4-1/src/runtime/time.go	2022-07-12 15:22:58.000000000 +0000
+++ 1.18.5-1/src/runtime/time.go	2022-07-29 16:11:09.000000000 +0000
@@ -391,7 +391,11 @@ func dodeltimer(pp *p, i int) int {
 	if i == 0 {
 		updateTimer0When(pp)
 	}
-	atomic.Xadd(&pp.numTimers, -1)
+	n := atomic.Xadd(&pp.numTimers, -1)
+	if n == 0 {
+		// If there are no timers, then clearly none are modified.
+		atomic.Store64(&pp.timerModifiedEarliest, 0)
+	}
 	return smallestChanged
 }
 
@@ -415,7 +419,11 @@ func dodeltimer0(pp *p) {
 		siftdownTimer(pp.timers, 0)
 	}
 	updateTimer0When(pp)
-	atomic.Xadd(&pp.numTimers, -1)
+	n := atomic.Xadd(&pp.numTimers, -1)
+	if n == 0 {
+		// If there are no timers, then clearly none are modified.
+		atomic.Store64(&pp.timerModifiedEarliest, 0)
+	}
 }
 
 // modtimer modifies an existing timer.
diff -pruN 1.18.4-1/src/runtime/traceback.go 1.18.5-1/src/runtime/traceback.go
--- 1.18.4-1/src/runtime/traceback.go	2022-07-12 15:22:58.000000000 +0000
+++ 1.18.5-1/src/runtime/traceback.go	2022-07-29 16:11:09.000000000 +0000
@@ -82,6 +82,7 @@ func gentraceback(pc0, sp0, lr0 uintptr,
 	}
 	waspanic := false
 	cgoCtxt := gp.cgoCtxt
+	stack := gp.stack
 	printing := pcbuf == nil && callback == nil
 
 	// If the PC is zero, it's likely a nil function call.
@@ -114,7 +115,7 @@ func gentraceback(pc0, sp0, lr0 uintptr,
 	if !f.valid() {
 		if callback != nil || printing {
 			print("runtime: unknown pc ", hex(frame.pc), "\n")
-			tracebackHexdump(gp.stack, &frame, 0)
+			tracebackHexdump(stack, &frame, 0)
 		}
 		if callback != nil {
 			throw("unknown pc")
@@ -174,12 +175,15 @@ func gentraceback(pc0, sp0, lr0 uintptr,
 					frame.fn = findfunc(frame.pc)
 					f = frame.fn
 					flag = f.flag
+					frame.lr = gp.m.curg.sched.lr
 					frame.sp = gp.m.curg.sched.sp
+					stack = gp.m.curg.stack
 					cgoCtxt = gp.m.curg.cgoCtxt
 				case funcID_systemstack:
 					// systemstack returns normally, so just follow the
 					// stack transition.
 					frame.sp = gp.m.curg.sched.sp
+					stack = gp.m.curg.stack
 					cgoCtxt = gp.m.curg.cgoCtxt
 					flag &^= funcFlag_SPWRITE
 				}
@@ -248,7 +252,7 @@ func gentraceback(pc0, sp0, lr0 uintptr,
 				}
 				if callback != nil || doPrint {
 					print("runtime: unexpected return pc for ", funcname(f), " called from ", hex(frame.lr), "\n")
-					tracebackHexdump(gp.stack, &frame, lrPtr)
+					tracebackHexdump(stack, &frame, lrPtr)
 				}
 				if callback != nil {
 					throw("unknown caller pc")
@@ -477,6 +481,13 @@ func gentraceback(pc0, sp0, lr0 uintptr,
 			break
 		}
 
+		if frame.pc == frame.lr && frame.sp == frame.fp {
+			// If the next frame is identical to the current frame, we cannot make progress.
+			print("runtime: traceback stuck. pc=", hex(frame.pc), " sp=", hex(frame.sp), "\n")
+			tracebackHexdump(stack, &frame, frame.sp)
+			throw("traceback stuck")
+		}
+
 		// Unwind to next frame.
 		frame.fn = flr
 		frame.pc = frame.lr
diff -pruN 1.18.4-1/src/testing/testing.go 1.18.5-1/src/testing/testing.go
--- 1.18.4-1/src/testing/testing.go	2022-07-12 15:22:58.000000000 +0000
+++ 1.18.5-1/src/testing/testing.go	2022-07-29 16:11:09.000000000 +0000
@@ -1122,7 +1122,7 @@ func removeAll(path string) error {
 	)
 	for {
 		err := os.RemoveAll(path)
-		if !isWindowsAccessDenied(err) {
+		if !isWindowsRetryable(err) {
 			return err
 		}
 		if start.IsZero() {
diff -pruN 1.18.4-1/src/testing/testing_other.go 1.18.5-1/src/testing/testing_other.go
--- 1.18.4-1/src/testing/testing_other.go	2022-07-12 15:22:58.000000000 +0000
+++ 1.18.5-1/src/testing/testing_other.go	2022-07-29 16:11:09.000000000 +0000
@@ -6,8 +6,8 @@
 
 package testing
 
-// isWindowsAccessDenied reports whether err is ERROR_ACCESS_DENIED,
-// which is defined only on Windows.
-func isWindowsAccessDenied(err error) bool {
+// isWindowsRetryable reports whether err is a Windows error code
+// that may be fixed by retrying a failed filesystem operation.
+func isWindowsRetryable(err error) bool {
 	return false
 }
diff -pruN 1.18.4-1/src/testing/testing_windows.go 1.18.5-1/src/testing/testing_windows.go
--- 1.18.4-1/src/testing/testing_windows.go	2022-07-12 15:22:58.000000000 +0000
+++ 1.18.5-1/src/testing/testing_windows.go	2022-07-29 16:11:09.000000000 +0000
@@ -8,11 +8,25 @@ package testing
 
 import (
 	"errors"
+	"internal/syscall/windows"
 	"syscall"
 )
 
-// isWindowsAccessDenied reports whether err is ERROR_ACCESS_DENIED,
-// which is defined only on Windows.
-func isWindowsAccessDenied(err error) bool {
-	return errors.Is(err, syscall.ERROR_ACCESS_DENIED)
+// isWindowsRetryable reports whether err is a Windows error code
+// that may be fixed by retrying a failed filesystem operation.
+func isWindowsRetryable(err error) bool {
+	for {
+		unwrapped := errors.Unwrap(err)
+		if unwrapped == nil {
+			break
+		}
+		err = unwrapped
+	}
+	if err == syscall.ERROR_ACCESS_DENIED {
+		return true // Observed in https://go.dev/issue/50051.
+	}
+	if err == windows.ERROR_SHARING_VIOLATION {
+		return true // Observed in https://go.dev/issue/51442.
+	}
+	return false
 }
diff -pruN 1.18.4-1/test/fixedbugs/issue52953.go 1.18.5-1/test/fixedbugs/issue52953.go
--- 1.18.4-1/test/fixedbugs/issue52953.go	1970-01-01 00:00:00.000000000 +0000
+++ 1.18.5-1/test/fixedbugs/issue52953.go	2022-07-29 16:11:10.000000000 +0000
@@ -0,0 +1,29 @@
+// run
+
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Issue 52953: miscompilation for composite literal assignment
+// when LHS is address-taken.
+
+package main
+
+type T struct {
+	Field1 bool
+}
+
+func main() {
+	var ret T
+	ret.Field1 = true
+	var v *bool = &ret.Field1
+	ret = T{Field1: *v}
+	check(ret.Field1)
+}
+
+//go:noinline
+func check(b bool) {
+	if !b {
+		panic("FAIL")
+	}
+}
diff -pruN 1.18.4-1/test/typeparam/issue51840.go 1.18.5-1/test/typeparam/issue51840.go
--- 1.18.4-1/test/typeparam/issue51840.go	2022-07-12 15:22:59.000000000 +0000
+++ 1.18.5-1/test/typeparam/issue51840.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,36 +0,0 @@
-// compile -G=3
-
-// Copyright 2022 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package main
-
-type Addr struct {
-	hi uint64
-	lo uint64
-	z  *byte
-}
-
-func EqualMap[M1, M2 ~map[K]V, K, V comparable](m1 M1, m2 M2) bool {
-	for k, v1 := range m1 {
-		if v2, ok := m2[k]; !ok || v1 != v2 {
-			return false
-		}
-	}
-	return true
-}
-
-type Set[T comparable] map[T]struct{}
-
-func NewSet[T comparable](items ...T) Set[T] {
-	return nil
-}
-
-func (s Set[T]) Equals(other Set[T]) bool {
-	return EqualMap(s, other)
-}
-
-func main() {
-	NewSet[Addr](Addr{0, 0, nil})
-}
diff -pruN 1.18.4-1/test/typeparam/issue53309.go 1.18.5-1/test/typeparam/issue53309.go
--- 1.18.4-1/test/typeparam/issue53309.go	2022-07-12 15:22:59.000000000 +0000
+++ 1.18.5-1/test/typeparam/issue53309.go	1970-01-01 00:00:00.000000000 +0000
@@ -1,42 +0,0 @@
-// run -gcflags=-G=3
-
-// Copyright 2022 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package main
-
-type TaskInput interface {
-	deps() []*taskDefinition
-}
-
-type Value[T any] interface {
-	metaValue
-}
-
-type metaValue interface {
-	TaskInput
-}
-
-type taskDefinition struct {
-}
-
-type taskResult struct {
-	task *taskDefinition
-}
-
-func (tr *taskResult) deps() []*taskDefinition {
-	return nil
-}
-
-func use[T any](v Value[T]) {
-	_, ok := v.(*taskResult)
-	if !ok {
-		panic("output must be *taskResult")
-	}
-}
-
-func main() {
-	tr := &taskResult{&taskDefinition{}}
-	use(Value[string](tr))
-}
diff -pruN 1.18.4-1/VERSION 1.18.5-1/VERSION
--- 1.18.4-1/VERSION	2022-07-12 15:22:53.000000000 +0000
+++ 1.18.5-1/VERSION	2022-07-29 16:11:04.000000000 +0000
@@ -1 +1 @@
-go1.18.4
\ No newline at end of file
+go1.18.5
\ No newline at end of file