RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-02
stories 9
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

HTTP/2 TRAILER TRUNCATION BUG FIXED, HEADER LIMITS TIGHTENED ACROSS THE STACK

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Go's HTTP/2 implementation was silently dropping trailer headers that exceeded limits instead of erroring, a behavior now corrected alongside new per-server header count controls.

The most critical fix lands in net/http/internal/http2 [1], where trailers exceeding MaxResponseHeaderBytes would vanish without warning. That's the kind of silent data loss that surfaces months later in production. Paired with this, net/http gains a new MaxHeaderValueCount setting [2] that lets you limit header quantity while keeping MaxHeaderBytes high for legitimate large headers like SSO cookies, a real pain point for OIDC-heavy deployments. Meanwhile, math/big patches an edge case in float formatting [3] where trailing-zero trimming could push the index past the mantissa bounds, and golang/sync hardens semaphore.Weighted to panic on negative weights [4] instead of silently corrupting internal state. The tools ecosystem saw goimports skip js/wasm test execution [6] to fix CI noise, and gopls regained semantic token backwards compatibility [7] with v0.11.0 clients. One revert [5] pulled a header timeout check for HTTP/2 to keep rc2 consistent with the minors branch until rc3.

Action items

References

  1. [1] net/http/internal/http2: do not silently truncate large trailers ↗ golang/go
  2. [2] net/http: add Server.MaxHeaderValueCount setting ↗ golang/go
  3. [3] math/big: fix edge case float formatting ↗ golang/go
  4. [4] semaphore: panic on negative weights ↗ golang/sync
  5. [5] Revert "net/http: apply header timeout to server's unencrypted HTTP/2 check" ↗ golang/go
  6. [6] cmd/goimports: skip TestCmd on js/wasm ↗ golang/tools
  7. [7] gopls/internal/test: have semtok work with gopls@v0.11.0 ↗ golang/tools

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on July 2, 2026?
Go's HTTP/2 implementation was silently dropping trailer headers that exceeded limits instead of erroring, a behavior now corrected alongside new per-server header count controls. In total, 9 commits landed.
What were the notable Go updates?
net/http/internal/http2: do not silently truncate large trailers, net/http: add Server.MaxHeaderValueCount setting, and math/big: fix edge case float formatting.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.