RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-20
stories 59
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

CRYPTO/TLS PURGE: GO DUMPS UNSAFE RANDOMNESS KNOBS AND MLKEM WORKAROUNDS

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go is ripping out deprecated randomness controls from crypto/tls and cementing ML-KEM hybrid support as the forward path, signaling the end of an era of backwards compatibility knobs.

The core Go team deprecated Config.Rand and removed the tlsunsafeekm and tlsrsakex GODEBUG settings [1][2][3], cleaning up surface area that was already broken by design: ML-KEM encapsulation in X25519MLKEM768 never respected Config.Rand anyway, so the feature was fiction. In its place, crypto/tls now uses mlkem.GenerateKey directly [4], which better aligns with FIPS 140-3 compliance and kills the workaround pattern of passing random bytes to mlkem.NewDecapsulationKey. Over on pkgsite, the team shipped strict module path validation [5] that returns 400 BadRequest when a package path is submitted instead of a module path, plus added -goos and -goarch flags to the pkgsite-cli package command [6], improving discovery for cross-platform queries. vscode-go added a forrval snippet for single-variable range loops [7], reflecting Go 1.23+ patterns, and refactored form.ts to decouple from goCtx [8], making code more portable across extensions. The website tour now clarifies slice length semantics [9] to reduce confusion for learners. Build infrastructure tightened x-repo workflow closures [10] and pkgsite improved error messaging with fix suggestions [11]. These are all structural hygiene updates: Go is removing debt, not shipping features.

Action items

References

  1. [1] crypto/tls: deprecate Config.Rand golang/go ↗
  2. [2] crypto/tls: remove the tlsunsafeekm GODEBUG setting golang/go ↗
  3. [3] crypto/tls: remove tlsrsakex GODEBUG setting golang/go ↗
  4. [4] crypto/tls: use mlkem.GenerateKey for ML-KEM hybrids golang/go ↗
  5. [5] internal/api: strictly validate module paths ↗ golang/pkgsite
  6. [6] cmd/internal/pkgsite-cli: support -goos and -goarch flags in package command ↗ golang/pkgsite
  7. [7] snippets: add forrval snippet for single-variable range loops ↗ golang/vscode-go
  8. [8] extension/src: replace goCtx with vscode language client ↗ golang/vscode-go
  9. [9] _content/tour: clarify slice length wording in moretypes.article ↗ golang/website
  10. [10] internal/task: refactor closures in x-repo workflow ↗ golang/build
  11. [11] cmd/internal/pkgsite-cli/client: return fix suggestions ↗ golang/pkgsite

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on May 20, 2026?
Go is ripping out deprecated randomness controls from crypto/tls and cementing ML-KEM hybrid support as the forward path, signaling the end of an era of backwards compatibility knobs. In total, 59 commits landed.
What were the notable Go updates?
crypto/tls: deprecate Config.Rand, crypto/tls: remove the tlsunsafeekm GODEBUG setting, and crypto/tls: remove tlsrsakex GODEBUG setting.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.