RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-06
stories 22
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

GOPLS PATCHES CRITICAL NETWORK BINDING VULNERABILITY; JSON FORMAT ENTERS EXPERIMENTAL PHASE

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag.

gopls removed its -port debugging flag [1], which could implicitly bind to INADDR_ANY and expose the language server to network traffic—a vulnerability now explicitly rejected. The flag is deprecated in favor of explicit host binding (localhost recommended) via -listen=address. Meanwhile, encoding/json/v2 now gates the format tag option behind GOEXPERIMENT=jsonformat [2], a breaking change that requires opt-in to use custom field formatting. On the tooling front, gopls gained embedlit modernizer analysis [3] and published six modernizers for public use [4], while the modernize analysis suite expands to catch more outdated patterns. The HTTP/2 implementation in golang/net now wraps the stdlib version when building with Go 1.27+ [5], shifting the source of truth entirely into the standard library. pkg.go.dev's CLI got a usability overhaul with automatic pagination [6] and environment-aware platform detection [7]. A race condition in QUIC's streamForFrame was fixed [8], and golang/geo patched two integer overflow bugs in polyline decoding [9].

Action items

References

  1. [1] gopls/internal/cmd: remove gopls -port=int debugging flag ↗ golang/tools
  2. [2] encoding/json/v2: support `format` tag option behind goexperiment ↗ golang/go
  3. [3] gopls/internal/settings: add embedlit analyzer ↗ golang/tools
  4. [4] go/analysis/passes/modernize: publish modernizers ↗ golang/tools
  5. [5] http2: enable net/http wrapping when go >= 1.27 ↗ golang/net
  6. [6] cmd/internal/pkgsite-cli: implement auto-pagination ↗ golang/pkgsite
  7. [7] cmd/internal/pkgsite-cli: remove -goos and -goarch flags and use go env ↗ golang/pkgsite
  8. [8] quic: fix data race in streamForFrame ↗ golang/net
  9. [9] add FuzzDecodePolyline. Fix 2 overflow bugs revealed by the test. (#270) ↗ golang/geo

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on May 6, 2026?
gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag. In total, 21 commits and 1 pull requests landed.
What were the notable Go updates?
gopls/internal/cmd: remove gopls -port=int debugging flag, encoding/json/v2: support `format` tag option behind goexperiment, and gopls/internal/settings: add embedlit analyzer.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.