RepoJournal
Go @golang
118 wires and counting

$ follow Go

Keep up with Go in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-14
stories 18
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

GO CRYPTO FIXES RSA KEY INTEROP WHILE RUNTIME CATCHES ARM64 SCANNING BUG

By RepoJournal · Filed · About Go · Composed from the cited sources · methodology

Nicola Murino Nicholas S. Husin cuishuang khr@golang.org Julian Soreavis Sean Rogers Meng Zhuo
8 people shipped this
Nicola Murino @drakkan 2 cited Nicholas S. Husin @nicholashusin 2 cited cuishuang @cuishuang 1 cited khr@golang.org @randall77 1 cited Julian Soreavis @soreavis Sean Rogers @seanrogers2657 Meng Zhuo @mengzhuo dependabot @dependabot

The crypto/ssh package is raising its RSA modulus limit to 16384 bits to accept keys that OpenSSH actually generates, while the runtime team patches a critical garbage collection miss on ARM64.

The ssh package [1] had capped RSA modulus at 8192 bits to bound CPU costs, but that rejected valid keys from ssh-keygen. This limit is now raised to 16384 bits across both the public key parser and OpenSSH private key parser, with prime factors capped at 8192. Alongside this, ssh error messages [2] are being sanitized to prevent control character injection from untrusted peers, and the server no longer tears down connections [3] when it encounters an unparseable public key, allowing clients to fall back to other authentication methods. On the runtime side, ARM64 systems have a critical bug [6] where small frames created during async preemption aren't scanned for pointers, meaning objects referenced by R30 can be garbage collected prematurely. The HTTP/3 implementation [4] now properly handles the 100 Continue expectation, and the compiler [5] removed a now-useless ABIConfig.Copy method that was treating returns as fresh copies when it was just returning itself.

$ ls golang/reviews/ # the step-back reads

the week in review Go 1.27.1 lands as plan9 early export disabled the month in review Go compiler hardens binaries, crypto tightens SSH safety
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in Go on July 14, 2026?
The crypto/ssh package is raising its RSA modulus limit to 16384 bits to accept keys that OpenSSH actually generates, while the runtime team patches a critical garbage collection miss on ARM64. In total, 16 commits and 2 pull requests landed.
Who contributed to Go on July 14, 2026?
8 developers shipped this update, including Nicola Murino, Nicholas S. Husin, cuishuang, khr@golang.org, Julian Soreavis, Sean Rogers, Meng Zhuo, and dependabot.
What were the notable Go updates?
ssh: raise the RSA modulus limit to 16384 bits, ssh: sanitize various error messages, and ssh: don't close the connection on an unparseable public key.
♥

$ log @golang --recent

Salsa20 gets a loong64 SIMD path 1 shipped LoongArch crypto gets SIMD, RISC-V bit tests slim down 9 shipped Go's QUIC stack learns to tell on-path from off-path, and amd64 gets v2/v3/v4 CPU bits 19 shipped pkgsite drops ctxhttp, tour returns real 404s 7 shipped

$ log --all # elsewhere on the wire

@open-webui Open WebUI 0.11.4 ships a slim image 89% smaller FastAPI & Pydantic SQLModel narrows SQLAlchemy type handling in Field, drops dataclass_transform shim

$ ls showcases/

Rails Django Laravel Node.js Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.