RepoJournal
Go @golang
167 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-08
stories 16
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

VULNDB INGESTS 86 NEW VULNERABILITY REPORTS OVERNIGHT

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

The vulnerability database shipped 86 new security advisories in four separate CLs, covering first-party Go issues and third-party dependency vulnerabilities that your supply chain scanner needs to know about.

Vulndb landed four major report batches [1][2][3][4] registering everything from GO-2026-5932 through GO-2026-5916, plus two critical first-party issues that fix golang/go#4970 and golang/go#5856 [4]. This is the scale of intake you expect during a vulnerability disclosure season. Meanwhile, Go 1.27 RC2 landed in gopls tooling [5], meaning your LSP completion benchmarks already run against the release candidate. On the idna front, both golang/net and golang/text rejected a long-standing UTS 46 specification bug that incorrectly permitted Punycode labels encoding pure ASCII strings like "xn--example-.com" [6][7]. This closes golang/go#78760. In gopls internals, completion benchmarks now enforce empty-range semantics [8], and the nilness analyzer learned to skip cgo magic functions that clobber SSA assumptions [9].

Action items

References

  1. [1] data/reports: add 17 reports ↗ golang/vulndb
  2. [2] data/reports: add 23 reports ↗ golang/vulndb
  3. [3] data/reports: add 45 reports ↗ golang/vulndb
  4. [4] data/reports: add 2 first-party reports ↗ golang/vulndb
  5. [5] internal/stdlib: update stdlib index for Go 1.27 Release Candidate 2 ↗ golang/tools
  6. [6] idna: reject all-ASCII xn-- labels on all Go versions ↗ golang/net
  7. [7] internal/export/idna: always treat Punycode encoding pure ASCII as an error ↗ golang/text
  8. [8] gopls/internal/test: Completion benchmarks use empty range ↗ golang/tools
  9. [9] go/analysis/passes/nilness: skip magic cgo functions ↗ golang/tools

$ ls golang/reviews/ # the step-back reads

the week in review FIPS 140 crypto fixes land across SHA-3, TLS 1.2, HKDF the month in review Go toolchain patches three CVEs as gopls hits v0.24.0
Full archive → Weekly reviews →

Quick answers

What shipped in Go on July 8, 2026?
The vulnerability database shipped 86 new security advisories in four separate CLs, covering first-party Go issues and third-party dependency vulnerabilities that your supply chain scanner needs to know about. In total, 16 commits landed.
What were the notable Go updates?
data/reports: add 17 reports, data/reports: add 23 reports, and data/reports: add 45 reports.
♥

$ log @golang --recent

RISC-V Zfa assembly support, and a faster archsimd unifier 9 shipped Plan 9 Mkdir race fixed, riscv64 gets clobberdead mode 7 shipped gopls closes a CVE on dash-prefixed module paths, and the exp collections get a Set 52 shipped Compiler stops lifting unsafe.Pointer arithmetic 35 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.