What were the notable Go updates?

crypto/tls: deprecate Config.Rand, crypto/tls: remove the tlsunsafeekm GODEBUG setting, and crypto/tls: remove tlsrsakex GODEBUG setting.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CRYPTO/TLS PURGE: GO DUMPS UNSAFE RANDOMNESS KNOBS AND MLKEM WORKAROUNDS

By RepoJournal · Filed 06:01 UTC on May 20, 2026 · About Go

Go is ripping out deprecated randomness controls from crypto/tls and cementing ML-KEM hybrid support as the forward path, signaling the end of an era of backwards compatibility knobs.

The core Go team deprecated Config.Rand and removed the tlsunsafeekm and tlsrsakex GODEBUG settings [1][2][3], cleaning up surface area that was already broken by design: ML-KEM encapsulation in X25519MLKEM768 never respected Config.Rand anyway, so the feature was fiction. In its place, crypto/tls now uses mlkem.GenerateKey directly [4], which better aligns with FIPS 140-3 compliance and kills the workaround pattern of passing random bytes to mlkem.NewDecapsulationKey. Over on pkgsite, the team shipped strict module path validation [5] that returns 400 BadRequest when a package path is submitted instead of a module path, plus added -goos and -goarch flags to the pkgsite-cli package command [6], improving discovery for cross-platform queries. vscode-go added a forrval snippet for single-variable range loops [7], reflecting Go 1.23+ patterns, and refactored form.ts to decouple from goCtx [8], making code more portable across extensions. The website tour now clarifies slice length semantics [9] to reduce confusion for learners. Build infrastructure tightened x-repo workflow closures [10] and pkgsite improved error messaging with fix suggestions [11]. These are all structural hygiene updates: Go is removing debt, not shipping features.

Action items

→ Audit internal code for Config.Rand usage before next Go release cycle; it will error golang/go [plan]
→ Remove any tlsunsafeekm or tlsrsakex GODEBUG workarounds from your TLS configs golang/go [immediate]
→ Monitor pkgsite API client code for 400 BadRequest changes if you pass package paths golang/pkgsite [monitor]

References

[1] crypto/tls: deprecate Config.Rand golang/go
[2] crypto/tls: remove the tlsunsafeekm GODEBUG setting golang/go
[3] crypto/tls: remove tlsrsakex GODEBUG setting golang/go
[4] crypto/tls: use mlkem.GenerateKey for ML-KEM hybrids golang/go
[5] internal/api: strictly validate module paths golang/pkgsite
[6] cmd/internal/pkgsite-cli: support -goos and -goarch flags in package command golang/pkgsite
[7] snippets: add forrval snippet for single-variable range loops golang/vscode-go
[8] extension/src: replace goCtx with vscode language client golang/vscode-go
[9] _content/tour: clarify slice length wording in moretypes.article golang/website
[10] internal/task: refactor closures in x-repo workflow golang/build
[11] cmd/internal/pkgsite-cli/client: return fix suggestions golang/pkgsite

Quick answers

What shipped in Go on May 20, 2026?: Go is ripping out deprecated randomness controls from crypto/tls and cementing ML-KEM hybrid support as the forward path, signaling the end of an era of backwards compatibility knobs. In total, 59 commits landed.
What were the notable Go updates?: crypto/tls: deprecate Config.Rand, crypto/tls: remove the tlsunsafeekm GODEBUG setting, and crypto/tls: remove tlsrsakex GODEBUG setting.

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 1 day ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

@golang 2 days ago

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

go 21 shipped 2-min read

@golang 3 days ago

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

go 25 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.