RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-16
stories 11
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

NET/TEXTPROTO INJECTION FLAW OPENS ERROR MESSAGES TO ATTACKER CONTROL

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

An attacker can inject arbitrary content into errors returned by net/textproto when external input reaches the package unescaped, potentially exploiting HTTP clients that parse untrusted server headers.

The net/textproto package has been including user-controlled input directly in error messages without escaping [1]. This matters because HTTP clients naturally use ReadMIMEHeader to parse headers from servers, meaning an attacker controlling a server response can craft malicious header content that propagates through error strings. This is a real injection vector for applications that log or expose errors to downstream systems.

On the compiler side, Go's optimization pipeline got smarter about amd64 code generation [2]. The fix removes unnecessary roundtrips between flags, booleans, and flags again, cleaning up bloated generated assembly and improving both code size and efficiency. This is the kind of surgical optimization that accumulates into measurable wins across large binaries.

Escape analysis also tightened up: singly-assigned function variables can now be recognized as static [3], which means recursive closures won't pessimistically escape heap allocations anymore. QUIC's MAX_DATA frame handling got corrected [4] where sentLimit was being incorrectly accumulated instead of properly updated to reflect the last value sent to peers.

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on May 16, 2026?
An attacker can inject arbitrary content into errors returned by net/textproto when external input reaches the package unescaped, potentially exploiting HTTP clients that parse untrusted server headers. In total, 11 commits landed.
What were the notable Go updates?
net/textproto: escape arbitrary input when including them in errors, cmd/compile: remove flags → bool → flags roundtrips on amd64, and cmd/compile: treat singly-assigned func vars as static in escape analysis.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.