RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-28
stories 20
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

CRYPTO/X509 HOSTNAME VERIFICATION CUT FROM QUADRATIC TO LINEAR

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go's x509 certificate verification just got exponentially faster for domains with large SAN lists, eliminating a pathological case that scaled by hostname labels times certificate entries.

The crypto/x509 package shipped a critical optimization [1] that eliminates quadratic behavior in VerifyHostname when processing certificates with dozens of Subject Alternative Name entries. Previously, matchHostnames looped over every SAN and called strings.Split on the same hostname each time, causing verification time to scale with SAN count multiplied by hostname label count. This gets you from O(n*m) to O(n) on the common path. Separately, debug/gosym [2] fixed symbol handling for generic functions by masking bracketed expressions rather than removing them, preserving string indices and improving support for instantiated generics. The tools team is tightening gopls code generation: addtest [3] now emits t.Context() for Go 1.24+ modules instead of context.Background(), while analysis passes are broadening their heuristics [4] to detect test-only symbols by file name, not just function name. Finally, golang/crypto addressed a resource exhaustion vulnerability [5] in SSH server authentication by capping total userauth attempts at 128 per connection, closing a loop that would process requests indefinitely if clients triggered PartialSuccessError responses.

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on May 28, 2026?
Go's x509 certificate verification just got exponentially faster for domains with large SAN lists, eliminating a pathological case that scaled by hostname labels times certificate entries. In total, 20 commits landed.
What were the notable Go updates?
crypto/x509: split candidate hostname only once, debug/gosym: mask bracketed expressions rather than remove them, and gopls/internal/golang: addtest: emit t.Context() for Go 1.24+.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.