RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-17
stories 14
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

HTTP/2 FLOW CONTROL VALIDATION HARDENS NET/HTTP, BUILD PIPELINE DROPS 1.19 COMPAT

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go's HTTP/2 implementation now validates server SETTINGS frames against stream flow limits, closing a potential vector for limit violations [ref:2].

The net/http/internal/http2 package received two significant updates that tighten correctness and clarity. First, the test harness was simplified by dropping the synctestTest helper and calling synctest.Test directly [1], consolidating test infrastructure and improving maintainability. More critically, SETTINGS frame handling now enforces validation that server-sent flow control limit adjustments don't cause open streams to exceed their bounds [2], fixing issue #80035. On the build side, the CI pipeline removed -compat=1.19 flags since the minimum supported version is now 1.26 [4], keeping build configuration aligned with reality. The stdlib also clarified WriteRune documentation to explicitly specify return values are in bytes, not runes [3], addressing subtle API ambiguity. pkg.go.dev patched OpenAPI validation errors [5] that were breaking client generation and incorrectly exposing unexported fields, while gopls integration across pkgsite is now modernized [6]. Six new vulnerability reports entered the database [7], and the Go security documentation now has a working redirect for the decisions page [8].

Action items

References

  1. [1] net/http/internal/http2: call synctest.Test directly ↗ golang/go
  2. [2] net/http/internal/http2: verify SETTINGS from server against flow limits ↗ golang/go
  3. [3] bytes, strings: clarify WriteRune return values ↗ golang/go
  4. [4] internal/task: remove -compat=1.19 since minimum version is 1.26 ↗ golang/build
  5. [5] internal/api: fix OpenAPI validation errors ↗ golang/pkgsite
  6. [6] all: modernize with gopls ↗ golang/pkgsite
  7. [7] data/reports: add 6 reports ↗ golang/vulndb
  8. [8] Add redirect for security/decisions ↗ golang/website

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on June 17, 2026?
Go's HTTP/2 implementation now validates server SETTINGS frames against stream flow limits, closing a potential vector for limit violations [ref:2]. In total, 14 commits landed.
What were the notable Go updates?
net/http/internal/http2: call synctest.Test directly, net/http/internal/http2: verify SETTINGS from server against flow limits, and bytes, strings: clarify WriteRune return values.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.