RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-01
stories 13
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

HTTP/2 TIMEOUT BUG PATCHED IN NET/HTTP, COMPILER CRASHES FIXED ACROSS STACK

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go just plugged a timing hole in HTTP/2 preface detection that left connections exposed, while the compiler team cleaned up three separate miscompilation bugs that were crashing builds.

The net/http package was reading the HTTP/2 client preface from new connections with no timeout applied, a gap now closed by hoisting the header timeout into the server loop [1]. This matters because unencrypted HTTP/2 servers could hang indefinitely waiting for those initial bytes. Meanwhile, the compiler team reverted a recent init function optimization that broke variable initialization in synthetic functions [2], fixed a type canonicalization bug in shift operation rewrites that confirmed crashes [3], and patched simd emulation String methods that were entirely broken [4]. On the tooling side, gopls got two critical fixes: share objectpath.Encoder across type-checking batches to slash CPU usage from 22 seconds to 10.4 seconds [5], and detect testmain files without relying on GOCACHE to prevent spurious internal package errors [6]. The build infrastructure added metadata-based security comm fetching for RC releases [7], extending a pattern that's been working well in the two-minor-releases workflow.

Action items

References

  1. [1] net/http: apply header timeout to server's unencrypted HTTP/2 check ↗ golang/go
  2. [2] Revert "cmd/compile: speedup large init function compile time" ↗ golang/go
  3. [3] cmd/compile: fix misscompile in rewrite generic rules ↗ golang/go
  4. [4] simd: repaired emulation String methods for simd ↗ golang/go
  5. [5] gopls/internal/cache: share objectpath Encoder across batch ↗ golang/tools
  6. [6] gopls/internal/cache: detect testmain without GOCACHE ↗ golang/tools
  7. [7] cmd/relui: add metadata-based security comm fetching for RC releases ↗ golang/build
  8. [8] net: fix TestLookupCNAME ↗ golang/go

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on July 1, 2026?
Go just plugged a timing hole in HTTP/2 preface detection that left connections exposed, while the compiler team cleaned up three separate miscompilation bugs that were crashing builds. In total, 13 commits landed.
What were the notable Go updates?
net/http: apply header timeout to server's unencrypted HTTP/2 check, Revert "cmd/compile: speedup large init function compile time", and cmd/compile: fix misscompile in rewrite generic rules.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.