Who contributed to Go on July 13, 2026?

1 developer shipped this update, including Nicola Murino.

What were the notable Go updates?

ssh: enforce the source-address critical option for all auth callbacks, ssh: fix data race in the doClientServerAuth test helper, and ssh: initialize new channels fully before adding them to chanList.

@golang

Go and the standard library - backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO CRYPTO PATCHES SOURCE-ADDRESS VALIDATION BYPASS IN SSH

By RepoJournal · Filed 06:56 UTC on July 13, 2026 · About Go

1 person shipped this

Nicola Murino @drakkan 5 cited

CVE-2026-46595 closed a critical gap where SSH source-address restrictions weren't enforced consistently across all authentication methods.

The golang/crypto team shipped a fix [1] that extends source-address validation to all authentication callbacks, not just PublicKeyCallback. Previously, VerifiedPublicKeyCallback could return Permissions with CriticalOptions that bypassed the documented enforcement contract. The patch consolidates the check to a single point at the end of each authentication attempt, catching escapes from any auth path. Alongside the security fix, the team hardened the SSH implementation against race conditions [2] in test helpers, corrected channel initialization ordering [3] that could expose zero-valued fields to concurrent goroutines, and made channel.close idempotent [4] using sync.Once to prevent future panics. One thing to note: source-address options are IP-based and will never match non-IP transports like Unix domain sockets [5], a behavior now documented and tested.

Action items

→ Update golang.org/x/crypto to the latest commit and rebuild SSH-dependent services golang/crypto [immediate]
→ Review any custom SSH authentication callbacks that rely on Permissions.CriticalOptions golang/crypto [plan]
→ Test SSH source-address restrictions across all auth method paths in your application golang/crypto [plan]

References

[1] ssh: enforce the source-address critical option for all auth callbacks golang/crypto
[2] ssh: fix data race in the doClientServerAuth test helper golang/crypto
[3] ssh: initialize new channels fully before adding them to chanList golang/crypto
[4] ssh: make channel.close idempotent golang/crypto
[5] ssh: document and test source-address behavior for non-IP transports golang/crypto

Quick answers

What shipped in Go on July 13, 2026?: CVE-2026-46595 closed a critical gap where SSH source-address restrictions weren't enforced consistently across all authentication methods. In total, 6 commits landed.
Who contributed to Go on July 13, 2026?: 1 developer shipped this update, including Nicola Murino.
What were the notable Go updates?: ssh: enforce the source-address critical option for all auth callbacks, ssh: fix data race in the doClientServerAuth test helper, and ssh: initialize new channels fully before adding them to chanList.

COMPILER GETS SMARTER ABOUT FUNCTION ORDERING, BENCHMARK SUITE HITS BUILD SNAGS

Go's compiler now counts IR nodes to order functions more intelligently, while the benchmark harness stumbles on recent upgrades.

go 4 shipped 1-min read

@golang 2 days ago

GO STRIPS MIPS REGISTER ALLOCATOR SUPPORT

Go's compiler is ripping out HI/LO register support for MIPS, closing the door on a decade of architectural complexity that wasn't worth the maintenance tax.

go 2 shipped 1-min read

@golang 3 days ago

PRINTF ANALYZER GETS SMARTER, PLAYGROUND NEEDS GO 1.26

The printf linter stops falsely flagging intentional double newlines, while gotip now requires Go 1.26 to bootstrap.

go 13 shipped 1-min read

@golang 4 days ago

GO REWORKS HTTP/3 REGISTRATION, KILLS GLOBAL STATE IN MODULE LOADER

Damien Neil's paired changes to net/http and x/net/http3 fundamentally reshape how HTTP/3 integrates with the standard library, while Michael Matloob strips out state manipulation functions that no longer belong anywhere.

go 28 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.