What were the notable Go updates?

crypto/x509: split candidate hostname only once, debug/gosym: mask bracketed expressions rather than remove them, and gopls/internal/golang: addtest: emit t.Context() for Go 1.24+.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CRYPTO/X509 HOSTNAME VERIFICATION CUT FROM QUADRATIC TO LINEAR

By RepoJournal · Filed 06:01 UTC on May 28, 2026 · About Go

Go's x509 certificate verification just got exponentially faster for domains with large SAN lists, eliminating a pathological case that scaled by hostname labels times certificate entries.

The crypto/x509 package shipped a critical optimization [1] that eliminates quadratic behavior in VerifyHostname when processing certificates with dozens of Subject Alternative Name entries. Previously, matchHostnames looped over every SAN and called strings.Split on the same hostname each time, causing verification time to scale with SAN count multiplied by hostname label count. This gets you from O(n*m) to O(n) on the common path. Separately, debug/gosym [2] fixed symbol handling for generic functions by masking bracketed expressions rather than removing them, preserving string indices and improving support for instantiated generics. The tools team is tightening gopls code generation: addtest [3] now emits t.Context() for Go 1.24+ modules instead of context.Background(), while analysis passes are broadening their heuristics [4] to detect test-only symbols by file name, not just function name. Finally, golang/crypto addressed a resource exhaustion vulnerability [5] in SSH server authentication by capping total userauth attempts at 128 per connection, closing a loop that would process requests indefinitely if clients triggered PartialSuccessError responses.

Action items

→ Verify your x509 verification paths if you handle certs with 50+ SANs; this should visibly improve latency on update golang/go [plan]
→ Update golang/crypto if you run SSH servers exposed to untrusted clients golang/crypto [immediate]
→ Sync gopls if you're on Go 1.24 and use the 'Add test' code action golang/tools [monitor]

References

[1] crypto/x509: split candidate hostname only once golang/go
[2] debug/gosym: mask bracketed expressions rather than remove them golang/go
[3] gopls/internal/golang: addtest: emit t.Context() for Go 1.24+ golang/tools
[4] go/analysis/passes/inline: broaden "from own test" skip criterion golang/tools
[5] ssh: cap total userauth attempts per server connection golang/crypto

Quick answers

What shipped in Go on May 28, 2026?: Go's x509 certificate verification just got exponentially faster for domains with large SAN lists, eliminating a pathological case that scaled by hostname labels times certificate entries. In total, 20 commits landed.
What were the notable Go updates?: crypto/x509: split candidate hostname only once, debug/gosym: mask bracketed expressions rather than remove them, and gopls/internal/golang: addtest: emit t.Context() for Go 1.24+.

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 1 day ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

@golang 2 days ago

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

go 21 shipped 2-min read

@golang 3 days ago

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

go 25 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.