RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-16
stories 26
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

GOPLS OVERHAULS FLAG PARSING, IMAGE LIBRARY PATCHES THREE SECURITY HOLES

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

gopls is enforcing strict flag ordering for subcommands [ref:2] while golang/image ships three separate security fixes addressing memory exhaustion and potential crashes in TIFF and WebP decoders [ref:14] [ref:15] [ref:16].

The gopls refactor [1] replaces the tool's flag parsing logic with a multi-pass FlagSet dispatching mechanism, maintaining backward compatibility with existing serve invocation patterns while tightening discipline on other subcommands. This lands as the team continues hardening Go 1.27 tooling. Over in golang/image, three distinct vulnerabilities landed fixes overnight: TIFF decoder now rejects tiles sized so large they trigger excessive memory consumption [2], WebP decoder validates that VP8/VP8L chunk dimensions match canvas dimensions to prevent crashes [3], and 32-bit platform handling avoids panics on integer overflow [4]. A fourth image repo change [5] adds overflow checks when reading TIFF IFD entries. The core Go compiler [6] removed the GenericMethods experiment flag ahead of 1.27 release, while [7] harmonized error messages for invalid GODEBUG settings. gopls is also gaining better telemetry reporting for system stack problems [8], and the website documentation now covers the new LocalCertificate field [9] and SIMD packages [10].

Action items

References

  1. [1] gopls: implement simplified CLI flag parsing and dispatching ↗ golang/tools
  2. [2] tiff: reject tiles too much larger than the image ↗ golang/image
  3. [3] webp: require that VP8/VP8L dimensions match canvas dimensions ↗ golang/image
  4. [4] tiff: don't panic when decoding too-large image on 32-bit platforms ↗ golang/image
  5. [5] tiff: avoid overflow when reading IFD entries ↗ golang/image
  6. [6] internal/goexperiment: delete Flags.GenericMethods ↗ golang/go
  7. [7] cmd/go: harmonize error messages for invalid GODEBUG settings ↗ golang/go
  8. [8] x/tools{,gopls}: update x/telemetry ↗ golang/tools
  9. [9] _content/doc/go1.27: add release notes for the new LocalCertificate field ↗ golang/website
  10. [10] _content/doc/go1.27: document arch/simd and simd packages ↗ golang/website

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on June 16, 2026?
gopls is enforcing strict flag ordering for subcommands [ref:2] while golang/image ships three separate security fixes addressing memory exhaustion and potential crashes in TIFF and WebP decoders [ref:14] [ref:15] [ref:16]. In total, 26 commits landed.
What were the notable Go updates?
gopls: implement simplified CLI flag parsing and dispatching, tiff: reject tiles too much larger than the image, and webp: require that VP8/VP8L dimensions match canvas dimensions.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.