What were the notable Go updates?

data/reports: add 17 reports, data/reports: add 23 reports, and data/reports: add 45 reports.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

VULNDB INGESTS 86 NEW VULNERABILITY REPORTS OVERNIGHT

By RepoJournal · Filed 06:01 UTC on July 8, 2026 · About Go

The vulnerability database shipped 86 new security advisories in four separate CLs, covering first-party Go issues and third-party dependency vulnerabilities that your supply chain scanner needs to know about.

Vulndb landed four major report batches [1][2][3][4] registering everything from GO-2026-5932 through GO-2026-5916, plus two critical first-party issues that fix golang/go#4970 and golang/go#5856 [4]. This is the scale of intake you expect during a vulnerability disclosure season. Meanwhile, Go 1.27 RC2 landed in gopls tooling [5], meaning your LSP completion benchmarks already run against the release candidate. On the idna front, both golang/net and golang/text rejected a long-standing UTS 46 specification bug that incorrectly permitted Punycode labels encoding pure ASCII strings like "xn--example-.com" [6][7]. This closes golang/go#78760. In gopls internals, completion benchmarks now enforce empty-range semantics [8], and the nilness analyzer learned to skip cgo magic functions that clobber SSA assumptions [9].

Action items

→ Run govulncheck against your dependencies against the new 86-report database before your next security audit cycle golang/vulndb [plan]
→ Verify your IDNA domain parsing rejects all-ASCII xn-- prefixed labels after updating golang/net and golang/text golang/net [plan]
→ Update gopls to the latest if you run completion benchmarks in your test suite golang/tools [monitor]

References

[1] data/reports: add 17 reports golang/vulndb
[2] data/reports: add 23 reports golang/vulndb
[3] data/reports: add 45 reports golang/vulndb
[4] data/reports: add 2 first-party reports golang/vulndb
[5] internal/stdlib: update stdlib index for Go 1.27 Release Candidate 2 golang/tools
[6] idna: reject all-ASCII xn-- labels on all Go versions golang/net
[7] internal/export/idna: always treat Punycode encoding pure ASCII as an error golang/text
[8] gopls/internal/test: Completion benchmarks use empty range golang/tools
[9] go/analysis/passes/nilness: skip magic cgo functions golang/tools

Quick answers

What shipped in Go on July 8, 2026?: The vulnerability database shipped 86 new security advisories in four separate CLs, covering first-party Go issues and third-party dependency vulnerabilities that your supply chain scanner needs to know about. In total, 16 commits landed.
What were the notable Go updates?: data/reports: add 17 reports, data/reports: add 23 reports, and data/reports: add 45 reports.

COMPILER GETS SMARTER ABOUT FUNCTION ORDERING, BENCHMARK SUITE HITS BUILD SNAGS

Go's compiler now counts IR nodes to order functions more intelligently, while the benchmark harness stumbles on recent upgrades.

go 4 shipped 1-min read

@golang 2 days ago

GO STRIPS MIPS REGISTER ALLOCATOR SUPPORT

Go's compiler is ripping out HI/LO register support for MIPS, closing the door on a decade of architectural complexity that wasn't worth the maintenance tax.

go 2 shipped 1-min read

@golang 3 days ago

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 4 days ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.