because of https://twitter.com/golang/status/1283082582675070976 (CVE-2020-14039) and (CVE-2020-15586)
#11743 (closed)