What were the notable Go updates?

gopls: two mitigations for "surplus bytes" crash, gopls/test/integration/mist: Fix flaky test, and gopls/internal/test: address out of bounds panic in BenchmarkSemanticTokens.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GOPLS CRASHES ON MALFORMED CACHE, CRYPTO HARDENS SSH AGAINST HOSTILE PEERS

By RepoJournal · Filed 06:01 UTC on June 30, 2026 · About Go

The gopls language server has a mystery crash in its frob decoder that defenders are now treating as a hardware fault scenario, while the crypto team closes two SSH attack surfaces that silently drain memory and corrupt terminal output.

gopls is getting defensive. A "surplus bytes" error in frob decoding [1] that should be theoretically impossible is now being handled with explicit assertions and fallbacks, because field reports suggest it's happening anyway. That same cache rewrite is getting a stability pass across the board: a flaky module index initialization bug [2] is being fixed with explicit synchronization, the semantic token benchmarks are no longer panicking [3], and dead gob encoding code is being removed [4]. The vulncheck action parsing was also shadowed into invisibility [5], now fixed. On the crypto side, SSH agent forwarders are leaking 2 MiB per channel [6] because they ignore stderr stream data, letting receive windows go unreplenished. More critically, malicious SSH peers can send control characters and escape sequences in disconnect messages [7], which now get sanitized and escaped before display. The image library is also clarifying its threat model [8]: malicious images are defended against, but malicious fonts are not.

Action items

→ Pull golang/tools with the gopls cache fixes before your next build, especially if you have flaky test reports golang/tools [plan]
→ Update golang/crypto immediately if you use SSH agent forwarding; the 2 MiB leak per channel can degrade production systems under sustained connections golang/crypto [immediate]
→ Review golang/image font usage; document any assumptions about font source trust in your codebase golang/image [monitor]

References

[1] gopls: two mitigations for "surplus bytes" crash golang/tools
[2] gopls/test/integration/mist: Fix flaky test golang/tools
[3] gopls/internal/test: address out of bounds panic in BenchmarkSemanticTokens golang/tools
[4] gopls/internal/cache: delete dead (gob) code golang/tools
[5] gopls/internal/server: fix parsing vulncheck action golang/tools
[6] ssh/agent: drain channel stderr in agent forwarders golang/crypto
[7] ssh: sanitize client disconnect messages golang/crypto
[8] font: document (lack of) security hardening in font packages golang/image

Quick answers

What shipped in Go on June 30, 2026?: The gopls language server has a mystery crash in its frob decoder that defenders are now treating as a hardware fault scenario, while the crypto team closes two SSH attack surfaces that silently drain memory and corrupt terminal output. In total, 9 commits landed.
What were the notable Go updates?: gopls: two mitigations for "surplus bytes" crash, gopls/test/integration/mist: Fix flaky test, and gopls/internal/test: address out of bounds panic in BenchmarkSemanticTokens.

COMPILER GETS SMARTER ABOUT FUNCTION ORDERING, BENCHMARK SUITE HITS BUILD SNAGS

Go's compiler now counts IR nodes to order functions more intelligently, while the benchmark harness stumbles on recent upgrades.

go 4 shipped 1-min read

@golang 2 days ago

GO STRIPS MIPS REGISTER ALLOCATOR SUPPORT

Go's compiler is ripping out HI/LO register support for MIPS, closing the door on a decade of architectural complexity that wasn't worth the maintenance tax.

go 2 shipped 1-min read

@golang 3 days ago

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 4 days ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.