What were the notable Go updates?

net/http/internal/http2: call synctest.Test directly, net/http/internal/http2: verify SETTINGS from server against flow limits, and bytes, strings: clarify WriteRune return values.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

HTTP/2 FLOW CONTROL VALIDATION HARDENS NET/HTTP, BUILD PIPELINE DROPS 1.19 COMPAT

By RepoJournal · Filed 06:01 UTC on June 17, 2026 · About Go

Go's HTTP/2 implementation now validates server SETTINGS frames against stream flow limits, closing a potential vector for limit violations [ref:2].

The net/http/internal/http2 package received two significant updates that tighten correctness and clarity. First, the test harness was simplified by dropping the synctestTest helper and calling synctest.Test directly [1], consolidating test infrastructure and improving maintainability. More critically, SETTINGS frame handling now enforces validation that server-sent flow control limit adjustments don't cause open streams to exceed their bounds [2], fixing issue #80035. On the build side, the CI pipeline removed -compat=1.19 flags since the minimum supported version is now 1.26 [4], keeping build configuration aligned with reality. The stdlib also clarified WriteRune documentation to explicitly specify return values are in bytes, not runes [3], addressing subtle API ambiguity. pkg.go.dev patched OpenAPI validation errors [5] that were breaking client generation and incorrectly exposing unexported fields, while gopls integration across pkgsite is now modernized [6]. Six new vulnerability reports entered the database [7], and the Go security documentation now has a working redirect for the decisions page [8].

Action items

→ Review HTTP/2 SETTINGS handling if you manage proxies or load balancers using Go golang/go [monitor]
→ Update build configs to remove any remaining 1.19 compat flags if present golang/build [plan]
→ Check vulndb for the six new reports affecting your dependencies golang/vulndb [monitor]

References

[1] net/http/internal/http2: call synctest.Test directly golang/go
[2] net/http/internal/http2: verify SETTINGS from server against flow limits golang/go
[3] bytes, strings: clarify WriteRune return values golang/go
[4] internal/task: remove -compat=1.19 since minimum version is 1.26 golang/build
[5] internal/api: fix OpenAPI validation errors golang/pkgsite
[6] all: modernize with gopls golang/pkgsite
[7] data/reports: add 6 reports golang/vulndb
[8] Add redirect for security/decisions golang/website

Quick answers

What shipped in Go on June 17, 2026?: Go's HTTP/2 implementation now validates server SETTINGS frames against stream flow limits, closing a potential vector for limit violations [ref:2]. In total, 14 commits landed.
What were the notable Go updates?: net/http/internal/http2: call synctest.Test directly, net/http/internal/http2: verify SETTINGS from server against flow limits, and bytes, strings: clarify WriteRune return values.

COMPILER GETS SMARTER ABOUT FUNCTION ORDERING, BENCHMARK SUITE HITS BUILD SNAGS

Go's compiler now counts IR nodes to order functions more intelligently, while the benchmark harness stumbles on recent upgrades.

go 4 shipped 1-min read

@golang 2 days ago

GO STRIPS MIPS REGISTER ALLOCATOR SUPPORT

Go's compiler is ripping out HI/LO register support for MIPS, closing the door on a decade of architectural complexity that wasn't worth the maintenance tax.

go 2 shipped 1-min read

@golang 3 days ago

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 4 days ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.