Who contributed to Go on July 18, 2026?

7 developers shipped this update, including Damien Neil, Michael Matloob, Josh Bleecher Snyder, qiulaidongfeng, Akira, Madeline Kalil, and Alan Donovan.

What were the notable Go updates?

net/http/httputil: don't forward Upgrade: h2c headers, crypto/md5: improve instruction-level parallelism, and cmd/compile: rewrite x-y*z to fused multiply subtract for GOAMD64=v3.

@golang

Go and the standard library — backend infrastructure at scale

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

GO PATCHES HTTP/2 BYPASS IN REVERSEPROXY, COMPILER GAINS FUSION MATH

By RepoJournal · Filed 06:56 UTC on July 18, 2026 · About Go

7 people shipped this

Alan Donovan @adonovan 3 cited

Michael Matloob @matloob 2 cited

Damien Neil @neild 1 cited

Josh Bleecher Snyder @josharian 1 cited

Akira @Daquisu 1 cited

Madeline Kalil @madelinekalil 1 cited

qiulaidongfeng @qiulaidongfeng

ReverseProxy was forwarding h2c upgrade headers that let clients bypass your handlers entirely, and it's getting fixed today.

In brief

Go's net/http/httputil now blocks Upgrade: h2c headers in reverse proxies. closes a bypass where HTTP/2 Cleartext could slip through. simple fix, big security surface.
Go compiler now rewrites x-y*z into a single fused multiply-subtract instruction on GOAMD64=v3. fewer CPU cycles for a pattern that shows up everywhere.
crypto/md5 gets instruction-level parallelism improvements. md5 is broken, but it's still everywhere. faster broken is still useful.
Go's SSH callback now reports verified signature format. crypto/ssh lets you hook auth. now you actually know what algorithm did the work.
gopls can now Move Declaration with a skeleton outline. refactoring tool got smarter about where to put extracted functions.

The net/http/httputil package had a surprising security gap: it would forward Upgrade: h2c headers from clients to backends, allowing HTTP/1 connections to switch to unencrypted HTTP/2 and slip past the proxy's middleware [1]. That's getting rejected outright now. On the compiler front, Go is shipping instruction-level parallelism improvements to md5 [2] and rewriting x-y*z arithmetic to fused multiply-subtract for GOAMD64=v3 [3], both targeting the performance bottlenecks that were waiting on optimizer changes. Meanwhile, the toolchain is getting smarter about error reporting: binary-only packages will now fail at load time instead of mysteriously at build time [4], and gopls is adding Move Declaration as a code action for refactoring [5]. The crypto/ssh package is also fixing a subtle audit gap where RSA signature verification could report the wrong algorithm to callbacks [6]. Across the ecosystem, you're getting better debugging visibility in gopls with package-level symbol inspection [7], faster type analysis with RTA refactoring [8], and stricter inlay hints that recognize common error-ignore patterns [9].

Action items

→ Review and test the h2c header fix [ref:1] if you run ReverseProxy in production golang/go [immediate]
→ Update gopls for Move Declaration and inlay hint improvements when available golang/tools [plan]
→ Monitor crypto/ssh signature format handling in authentication callbacks golang/crypto [monitor]

References

[1] net/http/httputil: don't forward Upgrade: h2c headers golang/go
[2] crypto/md5: improve instruction-level parallelism golang/go
[3] cmd/compile: rewrite x-y*z to fused multiply subtract for GOAMD64=v3 golang/go
[4] cmd/go: identify error for binary-only packages when loading golang/go
[5] gopls/internal/golang: add Move Declaration skeleton golang/tools
[6] ssh: report verified signature format to callback golang/crypto
[7] gopls/internal/debug: show Package.Scope symbols golang/tools
[8] go/callgraph/rta: use typesinternal.ForEachElement golang/tools
[9] gopls/internal/golang: InlayHint: permit "ignore error" alternatives golang/tools

Quick answers

What shipped in Go on July 18, 2026?: ReverseProxy was forwarding h2c upgrade headers that let clients bypass your handlers entirely, and it's getting fixed today. In total, 22 commits landed.
Who contributed to Go on July 18, 2026?: 7 developers shipped this update, including Damien Neil, Michael Matloob, Josh Bleecher Snyder, qiulaidongfeng, Akira, Madeline Kalil, and Alan Donovan.
What were the notable Go updates?: net/http/httputil: don't forward Upgrade: h2c headers, crypto/md5: improve instruction-level parallelism, and cmd/compile: rewrite x-y*z to fused multiply subtract for GOAMD64=v3.

GO 1.24 TOOLCHAIN TACKLES GENERIC DOCS, ATOMIC OPS, AND TYPE INFERENCE

The Go compiler is shipping fixes for generic type documentation panics, 128-bit atomic alignment, and composite literal type inference in the same window that gopls gains better error handling detection.

go 25 shipped 2-min read

@golang 2 days ago

GO RUNTIME PATCHES ARM MISCOMPILATION, FIXES USERINFO VALIDATION IN CORS

The Go compiler just shipped critical fixes for ARM64 integer overflow handling and net/http now properly validates origin URLs, while pkgsite quietly ships Vertex AI embeddings infrastructure.

go 66 shipped 2-min read

@golang 3 days ago

NET/HTTP STOPS RELYING ON REQUEST BODY IMMUTABILITY

The Go standard library is removing unsafe type assertions that break when middleware wraps server request bodies, fixing a class of connection reuse bugs.

go 16 shipped 2-min read

@golang 4 days ago

GO CRYPTO FIXES RSA KEY INTEROP WHILE RUNTIME CATCHES ARM64 SCANNING BUG

The crypto/ssh package is raising its RSA modulus limit to 16384 bits to accept keys that OpenSSH actually generates, while the runtime team patches a critical garbage collection miss on ARM64.

go 18 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 6 hours ago

PACKAGE UPDATES ROLL ACROSS AUR DERIVED AND PROTON CACHYOS

Claude Desktop jumped to 1.22209.0, Zen Browser patched to 1.21.8b, and documentation fixes landed across the stack overnight.

infra 43 shipped 1-min read

Elixir & Phoenix about 6 hours ago

ELIXIR CUTS EXPONENTIAL GROWTH IN BDD INTERSECTIONS, PHOENIX LIVE VIEW SKIPS CLONES ON STABLE LISTS

The compiler just got smarter about preventing exponential blowup in type intersection logic, while Phoenix Live View stops wastefully copying keyed comprehensions that aren't moving.

elixir 16 shipped 1-min read

@dotnet about 6 hours ago

ASPNETCORE TIGHTENS AUTHORIZATION METADATA EVERYWHERE, BLAZOR DEBUGGING EXITS

Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook.

dotnet 58 shipped 2-min read

@spring-projects about 6 hours ago

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.

java 4 shipped 1-min read