RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-15
stories 6
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

GO RUNTIME MEMORY TRAP DOCUMENTED AS FREEZE APPROACHES

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Image decoders can allocate memory proportional to untrusted headers before validating pixel data, a security footgun that just got official guidance.

The Go team documented a critical memory allocation pattern in image.Decode that catches developers off guard [1]. When decoding untrusted images, the function allocates buffers based on width and height from the image header before validating the actual pixel data, creating a denial-of-service vector. The fix isn't in the code, it's in the docs: use image.DecodeConfig to validate headers first, which reads only metadata without full buffer allocation [1]. This lands as the freeze tightens, with HTTP/3 tests now disabled ahead of the next release [2]. Compiler work continues in parallel, with splitload type preservation fixes on 386 and AMD64 ensuring pointers don't silently convert to integers [3]. On the tooling front, VS Code Go now adds follow-cursor support to package outlines with configurable sorting [4], while pkg.go.dev fixed a deployment issue where missing Go CLI binaries broke external link resolution [5]. The mobile team aligned Objective-C setter selectors with sanitized property names, keeping bindings consistent with Cocoa conventions [6].

Action items

References

  1. [1] image, image/gif: document DecodeConfig before Decode for untrusted input ↗ golang/go
  2. [2] net/http: disable HTTP/3 tests prior to freeze ↗ golang/go
  3. [3] cmd/compile: preserve pointerness during splitload ↗ golang/go
  4. [4] extension: support follow cursor and sorting in package outline ↗ golang/vscode-go
  5. [5] internal/frontend: fall back to process env when go env fails ↗ golang/pkgsite
  6. [6] bind: align Objective-C setter selectors with sanitized property names ↗ golang/mobile

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on May 15, 2026?
Image decoders can allocate memory proportional to untrusted headers before validating pixel data, a security footgun that just got official guidance. In total, 6 commits landed.
What were the notable Go updates?
image, image/gif: document DecodeConfig before Decode for untrusted input, net/http: disable HTTP/3 tests prior to freeze, and cmd/compile: preserve pointerness during splitload.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.