What were the notable Go updates?

gopls: implement simplified CLI flag parsing and dispatching, tiff: reject tiles too much larger than the image, and webp: require that VP8/VP8L dimensions match canvas dimensions.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GOPLS OVERHAULS FLAG PARSING, IMAGE LIBRARY PATCHES THREE SECURITY HOLES

By RepoJournal · Filed 06:01 UTC on June 16, 2026 · About Go

gopls is enforcing strict flag ordering for subcommands [ref:2] while golang/image ships three separate security fixes addressing memory exhaustion and potential crashes in TIFF and WebP decoders [ref:14] [ref:15] [ref:16].

The gopls refactor [1] replaces the tool's flag parsing logic with a multi-pass FlagSet dispatching mechanism, maintaining backward compatibility with existing serve invocation patterns while tightening discipline on other subcommands. This lands as the team continues hardening Go 1.27 tooling. Over in golang/image, three distinct vulnerabilities landed fixes overnight: TIFF decoder now rejects tiles sized so large they trigger excessive memory consumption [2], WebP decoder validates that VP8/VP8L chunk dimensions match canvas dimensions to prevent crashes [3], and 32-bit platform handling avoids panics on integer overflow [4]. A fourth image repo change [5] adds overflow checks when reading TIFF IFD entries. The core Go compiler [6] removed the GenericMethods experiment flag ahead of 1.27 release, while [7] harmonized error messages for invalid GODEBUG settings. gopls is also gaining better telemetry reporting for system stack problems [8], and the website documentation now covers the new LocalCertificate field [9] and SIMD packages [10].

Action items

→ Review and test gopls flag parsing changes before next toolchain upgrade golang/tools [plan]
→ Update golang/image to pick up TIFF and WebP security patches golang/image [immediate]
→ Monitor Go 1.27 release notes for LocalCertificate and SIMD documentation golang/website [monitor]

References

[1] gopls: implement simplified CLI flag parsing and dispatching golang/tools
[2] tiff: reject tiles too much larger than the image golang/image
[3] webp: require that VP8/VP8L dimensions match canvas dimensions golang/image
[4] tiff: don't panic when decoding too-large image on 32-bit platforms golang/image
[5] tiff: avoid overflow when reading IFD entries golang/image
[6] internal/goexperiment: delete Flags.GenericMethods golang/go
[7] cmd/go: harmonize error messages for invalid GODEBUG settings golang/go
[8] x/tools{,gopls}: update x/telemetry golang/tools
[9] _content/doc/go1.27: add release notes for the new LocalCertificate field golang/website
[10] _content/doc/go1.27: document arch/simd and simd packages golang/website

Quick answers

What shipped in Go on June 16, 2026?: gopls is enforcing strict flag ordering for subcommands [ref:2] while golang/image ships three separate security fixes addressing memory exhaustion and potential crashes in TIFF and WebP decoders [ref:14] [ref:15] [ref:16]. In total, 26 commits landed.
What were the notable Go updates?: gopls: implement simplified CLI flag parsing and dispatching, tiff: reject tiles too much larger than the image, and webp: require that VP8/VP8L dimensions match canvas dimensions.

COMPILER GETS SMARTER ABOUT FUNCTION ORDERING, BENCHMARK SUITE HITS BUILD SNAGS

Go's compiler now counts IR nodes to order functions more intelligently, while the benchmark harness stumbles on recent upgrades.

go 4 shipped 1-min read

@golang 2 days ago

GO STRIPS MIPS REGISTER ALLOCATOR SUPPORT

Go's compiler is ripping out HI/LO register support for MIPS, closing the door on a decade of architectural complexity that wasn't worth the maintenance tax.

go 2 shipped 1-min read

@golang 3 days ago

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 4 days ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.