What were the notable Go updates?

image, image/gif: document DecodeConfig before Decode for untrusted input, net/http: disable HTTP/3 tests prior to freeze, and cmd/compile: preserve pointerness during splitload.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO RUNTIME MEMORY TRAP DOCUMENTED AS FREEZE APPROACHES

By RepoJournal · Filed 06:01 UTC on May 15, 2026 · About Go

Image decoders can allocate memory proportional to untrusted headers before validating pixel data, a security footgun that just got official guidance.

The Go team documented a critical memory allocation pattern in image.Decode that catches developers off guard [1]. When decoding untrusted images, the function allocates buffers based on width and height from the image header before validating the actual pixel data, creating a denial-of-service vector. The fix isn't in the code, it's in the docs: use image.DecodeConfig to validate headers first, which reads only metadata without full buffer allocation [1]. This lands as the freeze tightens, with HTTP/3 tests now disabled ahead of the next release [2]. Compiler work continues in parallel, with splitload type preservation fixes on 386 and AMD64 ensuring pointers don't silently convert to integers [3]. On the tooling front, VS Code Go now adds follow-cursor support to package outlines with configurable sorting [4], while pkg.go.dev fixed a deployment issue where missing Go CLI binaries broke external link resolution [5]. The mobile team aligned Objective-C setter selectors with sanitized property names, keeping bindings consistent with Cocoa conventions [6].

Action items

→ Review image decode usage in your codebase; validate headers with DecodeConfig before Decode on untrusted input golang/go [immediate]
→ Upgrade to the next Go release once HTTP/3 tests land; the freeze is now active golang/go [plan]
→ Update VS Code Go extension to use new package outline features golang/vscode-go [monitor]

References

[1] image, image/gif: document DecodeConfig before Decode for untrusted input golang/go
[2] net/http: disable HTTP/3 tests prior to freeze golang/go
[3] cmd/compile: preserve pointerness during splitload golang/go
[4] extension: support follow cursor and sorting in package outline golang/vscode-go
[5] internal/frontend: fall back to process env when go env fails golang/pkgsite
[6] bind: align Objective-C setter selectors with sanitized property names golang/mobile

Quick answers

What shipped in Go on May 15, 2026?: Image decoders can allocate memory proportional to untrusted headers before validating pixel data, a security footgun that just got official guidance. In total, 6 commits landed.
What were the notable Go updates?: image, image/gif: document DecodeConfig before Decode for untrusted input, net/http: disable HTTP/3 tests prior to freeze, and cmd/compile: preserve pointerness during splitload.

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 1 day ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

@golang 2 days ago

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

go 21 shipped 2-min read

@golang 3 days ago

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

go 25 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.