RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-07
stories 30
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

MIME DECODER QUADRATIC COMPLEXITY PATCHED; FIPS 140-3 DOCS FINALIZED

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go shipped a critical fix for a denial-of-service vulnerability in the mime package's WordDecoder that could consume unbounded CPU on malformed headers [ref:1], while the security team locked down FIPS 140-3 cryptographic module documentation across the ecosystem.

The mime.WordDecoder.DecodeHeader fix [1] addresses CVE-2026-42504 by skipping entire undecodable encoded-words instead of byte-by-byte processing — a change that eliminates quadratic complexity attacks on email headers and similar MIME-encoded payloads. Simultaneously, the Go website finalized FIPS 140-3 guidance [2][3][4][5][6], shifting users from the legacy GODEBUG=fips140 flag toward the new GOFIPS140 environment variable and the crypto/fips140.Version API, with explicit warnings against the restrictive fips140=only mode. On the runtime front, goroutineleakprofile is now always-on by default [7] — there's no longer an experiment toggle to disable it, simplifying the profiling surface. The deprecation checker in cmd/api [8][9] fixed false positives and negatives by enforcing the spec: deprecated markers must start a paragraph, not hide mid-sentence. Go's build toolchain addressed a deadlock condition in cmd/go [10], while gopls expanded its linter arsenal with an errorsastype analyzer [11] to catch incorrect errors.As patterns. Over on pkg.go.dev, the API layer refactored package endpoints [12][13][14] to reduce payload redundancy and generalize pagination testing — changes that improve developer experience without breaking existing integrations.

Action items

References

  1. [1] mime: avoid quadratic complexity in WordDecoder.DecodeHeader golang/go ↗
  2. [2] _content/doc/security: add FIPS 140-3 Go Cryptographic Module changelog ↗ golang/website
  3. [3] _content/doc/security: document the inprocess and certified aliases ↗ golang/website
  4. [4] _content/doc/security: document crypto/fips140.Version ↗ golang/website
  5. [5] _content/doc/security: deemphasize GODEBUG=fips140 in favor of GOFIPS140 ↗ golang/website
  6. [6] _content/doc/security: discourage use of GODEBUG=fips140=only ↗ golang/website
  7. [7] internal/goexperiment,runtime: drop goroutineleakprofile experiment ↗ golang/go
  8. [8] cmd/api: fix false positive and false negative in isDeprecated ↗ golang/go
  9. [9] cmd/api/testdata: add test case for issue 79145 ↗ golang/go
  10. [10] cmd/go: fix potention deadlock ↗ golang/go
  11. [11] gopls: add errorsastype analyzer ↗ golang/tools
  12. [12] internal/api: add fields to PackageInfo ↗ golang/pkgsite
  13. [13] internal/tests/api: generalize pagination tests ↗ golang/pkgsite
  14. [14] internal/api: factor out common packages fields ↗ golang/pkgsite

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on May 7, 2026?
Go shipped a critical fix for a denial-of-service vulnerability in the mime package's WordDecoder that could consume unbounded CPU on malformed headers [ref:1], while the security team locked down FIPS 140-3 cryptographic module documentation across the ecosystem. In total, 30 commits landed.
What were the notable Go updates?
mime: avoid quadratic complexity in WordDecoder.DecodeHeader, _content/doc/security: add FIPS 140-3 Go Cryptographic Module changelog, and _content/doc/security: document the inprocess and certified aliases.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.