- Ignore certificates that can't be parsed by Go in AndroidCAstore (e.g. certificates with negative serial number).
- Fix chain proxy with the combination of some protocols unable to connect.
- Add developer options to set GODEBUG and environment variables for the Go library. They are set after Go runtime initialization, therefore not all GODEBUG and environment variables can take effect.
- Re-enable R8 optimizations for the legacy flavor.
- Update Java version from 21 to 25.
About CVE-2026-98432 (NVD, golang-announce):
- Almost all the Linux kernels used by Android devices comes without MPTCP support, so it is a no-op to disable MPTCP.
- Mitigating the vulnerability by disabling MPTCP is not the appropriate way. While the demonstrated exploit requires MPTCP, the underlying bug resides within TCP and is not specific to MPTCP. The fix for this vulnerability is to upgrade to a patched kernel version. Even if this vulnerability can be mitigated by disabling MPTCP, an outdated kernel is still vulnerable to tons of other RCE vulnerabilities.
- Therefore, Exclave will not explicitly disable MPTCP like many other proxy software and network tools written in Go.
- If you did compile the kernel with MPTCP support, or you insist that MPTCP must be explicitly disabled like some other Go-written software, set the related GODEBUG value through developer options yourself.