RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-27
stories 11
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

GOLANG PATCHES CRYPTO RACE, TOOLS FIXES PLAN 9 COMPATIBILITY

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go's crypto/autocert library ships a critical data race fix while the tools team systematically hardens Plan 9 support across gopls and the standard library.

The most pressing fix landed in golang/crypto: Manager.createCert() had a classic data race where concurrent goroutines for the same domain were reading state.locked without holding a lock [1]. This is the kind of bug that only surfaces under load and causes mysterious production failures. The fix removes the racy field entirely and computes ownership state under proper synchronization. Meanwhile, golang/tools is in heavy cleanup mode for Plan 9. gopls/internal/telemetry now skips tests that depend on memory-mapped files, which Plan 9 doesn't support [2]. The internal/diff package swapped out Plan 9's incompatible diff command for ape/diff from the POSIX compatibility layer [3]. These aren't edge-case fixes: Plan 9 is a tier-1 platform for Go, and every test failure compounds. Over in golang/text, unicode/norm hit an infinite loop bug when processing invalid input because the character size could be zero [4]. The fix changes how the package reports invalid characters so downstream code doesn't have to check for zero-width characters everywhere. golang/go also shipped a TLS privacy hardening: ECH (Encrypted Client Hello) will no longer include the PSK extension in the outer hello, preventing attackers from harvesting and replaying outer client hellos [5]. None of these are flashy features, but they're exactly the kind of fixes that prevent 3 AM pages.

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on June 27, 2026?
Go's crypto/autocert library ships a critical data race fix while the tools team systematically hardens Plan 9 support across gopls and the standard library. In total, 11 commits landed.
What were the notable Go updates?
acme/autocert: fix data race in Manager.createCert, gopls/internal/telemetry: skip the telemetry test on Plan 9, and internal/diff: use ape/patch and ape/diff on Plan 9.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.