Accepted: `go list ./...` in module mode heads for the exit in Go 1.28

The Go team has accepted a proposal to disallow `go list ./...` in module mode, targeting Go 1.28, on the grounds that it almost never does what anyone actually wants. On the security side, an SSH knownhosts auth-bypass around unenforced @revoked CA keys in `x/crypto` is the one to patch, with a separate memory-exhaustion issue in `x/image` VP8L decoding rounding out the day's advisories. Elsewhere, a thread on keeping detached background goroutines alive past shutdown is a decent read for anyone still reaching for `context.WithoutCancel` and hoping for the best.