RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-30
stories 9
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

GOPLS CRASHES ON MALFORMED CACHE, CRYPTO HARDENS SSH AGAINST HOSTILE PEERS

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

The gopls language server has a mystery crash in its frob decoder that defenders are now treating as a hardware fault scenario, while the crypto team closes two SSH attack surfaces that silently drain memory and corrupt terminal output.

gopls is getting defensive. A "surplus bytes" error in frob decoding [1] that should be theoretically impossible is now being handled with explicit assertions and fallbacks, because field reports suggest it's happening anyway. That same cache rewrite is getting a stability pass across the board: a flaky module index initialization bug [2] is being fixed with explicit synchronization, the semantic token benchmarks are no longer panicking [3], and dead gob encoding code is being removed [4]. The vulncheck action parsing was also shadowed into invisibility [5], now fixed. On the crypto side, SSH agent forwarders are leaking 2 MiB per channel [6] because they ignore stderr stream data, letting receive windows go unreplenished. More critically, malicious SSH peers can send control characters and escape sequences in disconnect messages [7], which now get sanitized and escaped before display. The image library is also clarifying its threat model [8]: malicious images are defended against, but malicious fonts are not.

Action items

References

  1. [1] gopls: two mitigations for "surplus bytes" crash ↗ golang/tools
  2. [2] gopls/test/integration/mist: Fix flaky test ↗ golang/tools
  3. [3] gopls/internal/test: address out of bounds panic in BenchmarkSemanticTokens ↗ golang/tools
  4. [4] gopls/internal/cache: delete dead (gob) code ↗ golang/tools
  5. [5] gopls/internal/server: fix parsing vulncheck action ↗ golang/tools
  6. [6] ssh/agent: drain channel stderr in agent forwarders ↗ golang/crypto
  7. [7] ssh: sanitize client disconnect messages ↗ golang/crypto
  8. [8] font: document (lack of) security hardening in font packages ↗ golang/image

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on June 30, 2026?
The gopls language server has a mystery crash in its frob decoder that defenders are now treating as a hardware fault scenario, while the crypto team closes two SSH attack surfaces that silently drain memory and corrupt terminal output. In total, 9 commits landed.
What were the notable Go updates?
gopls: two mitigations for "surplus bytes" crash, gopls/test/integration/mist: Fix flaky test, and gopls/internal/test: address out of bounds panic in BenchmarkSemanticTokens.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.