Who contributed to Go on July 18, 2026?

7 developers shipped this update, including Damien Neil, Michael Matloob, Josh Bleecher Snyder, qiulaidongfeng, Akira, Madeline Kalil, and Alan Donovan.

What were the notable Go updates?

net/http/httputil: don't forward Upgrade: h2c headers, crypto/md5: improve instruction-level parallelism, and cmd/compile: rewrite x-y*z to fused multiply subtract for GOAMD64=v3.

Jul 18, 2026

$ the-wire · showcase

GO PATCHES HTTP/2 BYPASS IN REVERSEPROXY, COMPILER GAINS FUSION MATH

By RepoJournal · Filed 06:56 UTC on July 18, 2026 · About Go · Composed from the cited sources · methodology

7 people shipped this

Alan Donovan @adonovan 3 cited

Michael Matloob @matloob 2 cited

Damien Neil @neild 1 cited

Josh Bleecher Snyder @josharian 1 cited

Akira @Daquisu 1 cited

Madeline Kalil @madelinekalil 1 cited

qiulaidongfeng @qiulaidongfeng

ReverseProxy was forwarding h2c upgrade headers that let clients bypass your handlers entirely, and it's getting fixed today.

In brief

Go's net/http/httputil now blocks Upgrade: h2c headers in reverse proxies. closes a bypass where HTTP/2 Cleartext could slip through. simple fix, big security surface.
Go compiler now rewrites x-y*z into a single fused multiply-subtract instruction on GOAMD64=v3. fewer CPU cycles for a pattern that shows up everywhere.
crypto/md5 gets instruction-level parallelism improvements. md5 is broken, but it's still everywhere. faster broken is still useful.
Go's SSH callback now reports verified signature format. crypto/ssh lets you hook auth. now you actually know what algorithm did the work.
gopls can now Move Declaration with a skeleton outline. refactoring tool got smarter about where to put extracted functions.

The net/http/httputil package had a surprising security gap: it would forward Upgrade: h2c headers from clients to backends, allowing HTTP/1 connections to switch to unencrypted HTTP/2 and slip past the proxy's middleware [1]. That's getting rejected outright now. On the compiler front, Go is shipping instruction-level parallelism improvements to md5 [2] and rewriting x-y*z arithmetic to fused multiply-subtract for GOAMD64=v3 [3], both targeting the performance bottlenecks that were waiting on optimizer changes. Meanwhile, the toolchain is getting smarter about error reporting: binary-only packages will now fail at load time instead of mysteriously at build time [4], and gopls is adding Move Declaration as a code action for refactoring [5]. The crypto/ssh package is also fixing a subtle audit gap where RSA signature verification could report the wrong algorithm to callbacks [6]. Across the ecosystem, you're getting better debugging visibility in gopls with package-level symbol inspection [7], faster type analysis with RTA refactoring [8], and stricter inlay hints that recognize common error-ignore patterns [9].

Action items

→ Review and test the h2c header fix [ref:1] if you run ReverseProxy in production golang/go [immediate]
→ Update gopls for Move Declaration and inlay hint improvements when available golang/tools [plan]
→ Monitor crypto/ssh signature format handling in authentication callbacks golang/crypto [monitor]

References

[1] net/http/httputil: don't forward Upgrade: h2c headers ↗ golang/go
[2] crypto/md5: improve instruction-level parallelism ↗ golang/go
[3] cmd/compile: rewrite x-y*z to fused multiply subtract for GOAMD64=v3 ↗ golang/go
[4] cmd/go: identify error for binary-only packages when loading ↗ golang/go
[5] gopls/internal/golang: add Move Declaration skeleton ↗ golang/tools
[6] ssh: report verified signature format to callback ↗ golang/crypto
[7] gopls/internal/debug: show Package.Scope symbols ↗ golang/tools
[8] go/callgraph/rta: use typesinternal.ForEachElement ↗ golang/tools
[9] gopls/internal/golang: InlayHint: permit "ignore error" alternatives ↗ golang/tools