What were the notable Go updates?

net/textproto: escape arbitrary input when including them in errors, cmd/compile: remove flags → bool → flags roundtrips on amd64, and cmd/compile: treat singly-assigned func vars as static in escape analysis.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

NET/TEXTPROTO INJECTION FLAW OPENS ERROR MESSAGES TO ATTACKER CONTROL

By RepoJournal · Filed 06:01 UTC on May 16, 2026 · About Go

An attacker can inject arbitrary content into errors returned by net/textproto when external input reaches the package unescaped, potentially exploiting HTTP clients that parse untrusted server headers.

The net/textproto package has been including user-controlled input directly in error messages without escaping [1]. This matters because HTTP clients naturally use ReadMIMEHeader to parse headers from servers, meaning an attacker controlling a server response can craft malicious header content that propagates through error strings. This is a real injection vector for applications that log or expose errors to downstream systems.

On the compiler side, Go's optimization pipeline got smarter about amd64 code generation [2]. The fix removes unnecessary roundtrips between flags, booleans, and flags again, cleaning up bloated generated assembly and improving both code size and efficiency. This is the kind of surgical optimization that accumulates into measurable wins across large binaries.

Escape analysis also tightened up: singly-assigned function variables can now be recognized as static [3], which means recursive closures won't pessimistically escape heap allocations anymore. QUIC's MAX_DATA frame handling got corrected [4] where sentLimit was being incorrectly accumulated instead of properly updated to reflect the last value sent to peers.

Action items

→ Review any code using net/textproto that exposes error output; patch incoming golang/go [immediate]
→ Monitor next Go release for the escape analysis and compiler improvements golang/go [monitor]
→ If running QUIC-backed services, watch for the sentLimit fix in net module updates golang/net [plan]

References

[1] net/textproto: escape arbitrary input when including them in errors golang/go
[2] cmd/compile: remove flags → bool → flags roundtrips on amd64 golang/go
[3] cmd/compile: treat singly-assigned func vars as static in escape analysis golang/go
[4] quic: fix appendMaxDataFrame erroneously accumulating sentLimit golang/net

Quick answers

What shipped in Go on May 16, 2026?: An attacker can inject arbitrary content into errors returned by net/textproto when external input reaches the package unescaped, potentially exploiting HTTP clients that parse untrusted server headers. In total, 11 commits landed.
What were the notable Go updates?: net/textproto: escape arbitrary input when including them in errors, cmd/compile: remove flags → bool → flags roundtrips on amd64, and cmd/compile: treat singly-assigned func vars as static in escape analysis.

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 1 day ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

@golang 2 days ago

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

go 21 shipped 2-min read

@golang 3 days ago

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

go 25 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.