RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-19
stories 12
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

GO 1.27 RELEASE CANDIDATE LANDS, VULNDB PLUGS TWO NEW HOLES

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go 1.27 RC1 is available now [ref:11], and the vulnerability database just sealed two fresh CVEs while patching an insufficient fix from last month [ref:1] [ref:2] [ref:3].

The toolchain is ready for testing [5], with stdlib indexes refreshed across the ecosystem. On the security front, the vulndb team added GO-2026-5062 and GO-2026-5061 in quick succession [2] [3], then backfilled a followup fix for GO-2026-4961 after the original patch proved insufficient [4]. This is typical hardening work ahead of the final release, so audit your dependencies now if you're on any of those affected versions. Meanwhile, the http package gained trailer validation to block header injection attacks [6], a breaking change that tightens HTTP/1 request and response handling. The compiler saw SIMD repairs [7], a PGO profile refresh [8], and Plan 9 environment inheritance fixes [9] to ensure testdata builds work everywhere. A typo fix in the types2 comment landed too [10], the kind of polish that accumulates across releases.

Action items

References

  1. [1] dl: add go1.27rc1 ↗ golang/dl
  2. [2] data/reports: add GO-2026-5062 ↗ golang/vulndb
  3. [3] data/reports: add GO-2026-5061 ↗ golang/vulndb
  4. [4] data/reports: update fix version in GO-2026-4961 ↗ golang/vulndb
  5. [5] internal/stdlib: update stdlib index for Go 1.27 Release Candidate 1 ↗ golang/tools
  6. [6] net/http: validate trailers when writing requests and responses ↗ golang/go
  7. [7] simd: repair missed StorePart-returns-int in generated code ↗ golang/go
  8. [8] cmd/compile: update default PGO profile ↗ golang/go
  9. [9] simd: set GOEXPERIMENT in testdata tests ↗ golang/go
  10. [10] cmd/compile: fix typo in comment ↗ golang/go

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on June 19, 2026?
Go 1.27 RC1 is available now [ref:11], and the vulnerability database just sealed two fresh CVEs while patching an insufficient fix from last month [ref:1] [ref:2] [ref:3]. In total, 12 commits landed.
What were the notable Go updates?
dl: add go1.27rc1, data/reports: add GO-2026-5062, and data/reports: add GO-2026-5061.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.