The Wire · Showcase
HTTP/2 TIMEOUT BUG PATCHED IN NET/HTTP, COMPILER CRASHES FIXED ACROSS STACK
By RepoJournal · Filed · About Go
Go just plugged a timing hole in HTTP/2 preface detection that left connections exposed, while the compiler team cleaned up three separate miscompilation bugs that were crashing builds.
The net/http package was reading the HTTP/2 client preface from new connections with no timeout applied, a gap now closed by hoisting the header timeout into the server loop [1]. This matters because unencrypted HTTP/2 servers could hang indefinitely waiting for those initial bytes. Meanwhile, the compiler team reverted a recent init function optimization that broke variable initialization in synthetic functions [2], fixed a type canonicalization bug in shift operation rewrites that confirmed crashes [3], and patched simd emulation String methods that were entirely broken [4]. On the tooling side, gopls got two critical fixes: share objectpath.Encoder across type-checking batches to slash CPU usage from 22 seconds to 10.4 seconds [5], and detect testmain files without relying on GOCACHE to prevent spurious internal package errors [6]. The build infrastructure added metadata-based security comm fetching for RC releases [7], extending a pattern that's been working well in the two-minor-releases workflow.
Action items
- → Pull the HTTP/2 timeout fix [ref:1] before shipping any unencrypted HTTP/2 servers golang/go [immediate]
- → Sync compiler patches [ref:4] and [ref:5] immediately if you've hit init function crashes or shift operation miscompiles golang/go [immediate]
- → Update gopls to pick up the objectpath Encoder pooling [ref:8] and testmain detection fix [ref:9] golang/tools [plan]
- → Monitor the CNAME test change [ref:2] and simd String method repair [ref:3] in your test runs golang/go [monitor]
References
- [1] net/http: apply header timeout to server's unencrypted HTTP/2 check golang/go
- [2] Revert "cmd/compile: speedup large init function compile time" golang/go
- [3] cmd/compile: fix misscompile in rewrite generic rules golang/go
- [4] simd: repaired emulation String methods for simd golang/go
- [5] gopls/internal/cache: share objectpath Encoder across batch golang/tools
- [6] gopls/internal/cache: detect testmain without GOCACHE golang/tools
- [7] cmd/relui: add metadata-based security comm fetching for RC releases golang/build
- [8] net: fix TestLookupCNAME golang/go
FAQ
- What changed in Go on July 1, 2026?
- Go just plugged a timing hole in HTTP/2 preface detection that left connections exposed, while the compiler team cleaned up three separate miscompilation bugs that were crashing builds.
- What should Go teams do about it?
- Pull the HTTP/2 timeout fix [ref:1] before shipping any unencrypted HTTP/2 servers • Sync compiler patches [ref:4] and [ref:5] immediately if you've hit init function crashes or shift operation miscompiles • Update gopls to pick up the objectpath Encoder pooling [ref:8] and testmain detection fix [ref:9]
- Which Go repositories shipped on July 1, 2026?
- golang/go, golang/tools, golang/build