Who contributed to Go on July 14, 2026?

8 developers shipped this update, including Nicola Murino, Nicholas S. Husin, cuishuang, khr@golang.org, Julian Soreavis, Sean Rogers, Meng Zhuo, and dependabot.

What were the notable Go updates?

ssh: raise the RSA modulus limit to 16384 bits, ssh: sanitize various error messages, and ssh: don't close the connection on an unparseable public key.

@golang

Go and the standard library — backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO CRYPTO FIXES RSA KEY INTEROP WHILE RUNTIME CATCHES ARM64 SCANNING BUG

By RepoJournal · Filed 06:56 UTC on July 14, 2026 · About Go

8 people shipped this

Nicola Murino @drakkan 2 cited

Nicholas S. Husin @nicholashusin 2 cited

cuishuang @cuishuang 1 cited

[email protected] @randall77 1 cited

Julian Soreavis @soreavis

Sean Rogers @seanrogers2657

Meng Zhuo @mengzhuo

dependabot @dependabot

The crypto/ssh package is raising its RSA modulus limit to 16384 bits to accept keys that OpenSSH actually generates, while the runtime team patches a critical garbage collection miss on ARM64.

The ssh package [1] had capped RSA modulus at 8192 bits to bound CPU costs, but that rejected valid keys from ssh-keygen. This limit is now raised to 16384 bits across both the public key parser and OpenSSH private key parser, with prime factors capped at 8192. Alongside this, ssh error messages [2] are being sanitized to prevent control character injection from untrusted peers, and the server no longer tears down connections [3] when it encounters an unparseable public key, allowing clients to fall back to other authentication methods. On the runtime side, ARM64 systems have a critical bug [6] where small frames created during async preemption aren't scanned for pointers, meaning objects referenced by R30 can be garbage collected prematurely. The HTTP/3 implementation [4] now properly handles the 100 Continue expectation, and the compiler [5] removed a now-useless ABIConfig.Copy method that was treating returns as fresh copies when it was just returning itself.

Action items

→ Update golang/crypto immediately if you use ssh with RSA keys larger than 8192 bits golang/crypto [immediate]
→ Upgrade to latest golang/go if running ARM64 in production to patch the GC scanning miss golang/go [immediate]
→ Review ssh error handling if you parse untrusted public keys golang/crypto [plan]

References

[1] ssh: raise the RSA modulus limit to 16384 bits golang/crypto
[2] ssh: sanitize various error messages golang/crypto
[3] ssh: don't close the connection on an unparseable public key golang/crypto
[4] internal/http3: prevent request body read when 100 status was not sent golang/net
[5] cmd/compile: remove no-op ABIConfig.Copy golang/go
[6] runtime: be sure to scan small frame introduced by (*sigctxt).pushCall golang/go

Quick answers

What shipped in Go on July 14, 2026?: The crypto/ssh package is raising its RSA modulus limit to 16384 bits to accept keys that OpenSSH actually generates, while the runtime team patches a critical garbage collection miss on ARM64. In total, 16 commits and 2 pull requests landed.
Who contributed to Go on July 14, 2026?: 8 developers shipped this update, including Nicola Murino, Nicholas S. Husin, cuishuang, [email protected], Julian Soreavis, Sean Rogers, Meng Zhuo, and dependabot.
What were the notable Go updates?: ssh: raise the RSA modulus limit to 16384 bits, ssh: sanitize various error messages, and ssh: don't close the connection on an unparseable public key.

GO CRYPTO PATCHES SOURCE-ADDRESS VALIDATION BYPASS IN SSH

CVE-2026-46595 closed a critical gap where SSH source-address restrictions weren't enforced consistently across all authentication methods.

go 6 shipped 1-min read

@golang 3 days ago

GOPLS SANDBOX GETS EMERGENCY STABILITY FIX AS PLAYGROUND OVERHAULS DEPLOYMENT

The playground sandbox can no longer hang on container timeouts, and gopls is cleaning up internal linkname hacks that were recipes for trouble.

go 15 shipped 1-min read

@golang 4 days ago

GOPLS V0.23.0 SHIPS AS GO TOOLCHAIN FIXES PLAN 9 COMPATIBILITY

gopls 0.23.0 landed overnight while the Go core team fixes a Plan 9 regression in file removal that could break deployments on legacy systems.

go 17 shipped 1-min read

@golang 5 days ago

GOPLS ASSEMBLY SUPPORT LANDS, GODEP REFRESH ROLLS ACROSS ECOSYSTEM

The Go toolchain just got smarter about assembly files, and a coordinated dependency update is rolling through every major repo simultaneously.

go 10 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 4 hours ago

CACHYOS LINUX 7.2-RC3 SHIPS WITH HARDWARE FIXES AND EXPANDED LANGUAGE SUPPORT

CachyOS Linux 7.2-rc3-1 is live with Razer Blade speaker fixes and v4l2loopback updates, while the package installer now speaks Turkish and Azerbaijani.

infra 63 shipped 1-min read

Elixir & Phoenix about 4 hours ago

PHOENIX LIVE VIEW PATCHES SCHEME VALIDATION BYPASS

Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application.

elixir 6 shipped 1-min read

@dotnet about 4 hours ago

RUNTIME FIXES DECIMAL AND BIGINTEGER ROUNDING BUGS THAT LOST PRECISION

Three critical numeric conversion bugs that silently corrupted precision in decimal, BigInteger, and floating-point math are now fixed across the stack.

dotnet 122 shipped 1-min read

@spring-projects about 4 hours ago

SPRING BOOT PLUGS FILE HANDLE LEAK IN IMAGE BUILDPACK

Spring Boot's image buildpack was leaking file handles and orphaning temp files when resolving missing builder images, but a fix just landed to clean up both the streams and the intermediate artifacts.

java 16 shipped 1-min read