Go 1.9.1 stops trusting an SMTP advertisement
engineeringgosecuritysmtptoolingPlainAuth again requires TLS for remote servers, and go get rejects conflicting nested version-control metadata. Both fixes put checks before operations that depend on untrusted information.