RepoJournal
Go

@golang

Go and the standard library - backend infrastructure at scale

What actually shipped in Go, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Thu 11 jun
  2. Fri 12 jun
  3. Sat 13 jun
  4. Sun 14 jun
  5. Tue 16 jun
  6. Wed 17 jun
  7. Thu 18 jun
  8. Fri 19 jun
  9. Sat 27 jun
  10. Sun 28 jun
  11. Tue 30 jun
  12. Wed 1 jul
  13. Thu 2 jul
  14. Fri 3 jul
  15. Tue 7 jul
  16. Wed 8 jul
  17. Thu 9 jul
  18. Fri 10 jul
  19. Sat 11 jul
  20. Mon 13 jul
  21. Tue 14 jul
  22. Wed 15 jul
  23. Thu 16 jul
  24. Fri 17 jul
  25. Sat 18 jul
  26. Sun 19 jul
  27. Mon 20 jul
  28. Tue 21 jul
  29. Wed 22 jul
  30. Today 23 jul
Topics: Go Infrastructure Full archive →

The Wire · Showcase

GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS

By RepoJournal · Filed · About Go

Hana Kim Ian Alexander David Chase Keith Randall Nicholas S. Husin cuishuang Alan Donovan
11 people shipped this
Hana Kim @hyangah 2 cited Ian Alexander @jitsu-net 2 cited David Chase @dr2chase 1 cited Keith Randall @randall77 1 cited Nicholas S. Husin @nicholashusin 1 cited cuishuang @cuishuang 1 cited Alan Donovan @adonovan 1 cited Jean Barkhuysen @jeanbza Sean Liao @seankhliao Cuong Manh Le @cuonglm Hongxiang Jiang @h9jiang

A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.

Gopls shipped a fix for a code generation bug where suggested simplifications of redundant pointer composite literals would delete the wrong character when comments appeared between the ampersand and the type name [1]. The fix uses separate text edits to preserve inline comments while producing the same output as gofmt -s. On the vulnerability side, golang/vulndb merged two batches totaling 46 new security reports [2][3] covering various packages, continuing the steady ingestion of CVE data into the official Go vulnerability database. The compiler desk added developer-friendly tuning options with a new '-d=ssa/phase/@keyword=value' flag to simplify experimentation [4], while fixing edge cases in mergelocals on MIPS architectures [5] and plugging an overflow vulnerability in TLS ECH config parsing [6]. The golang/tools suite also gained two new analyzers for SQL row and scanner error handling that will ship with go1.28 [7]. Website infrastructure now redirects the legacy playground domains goprevplay, gotipplay, and go2goplay to go.dev/play [8][9], consolidating the playground experience. Across all desks, 21 commits landed addressing compiler robustness, tooling quality, and ecosystem vulnerability tracking.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] gopls/internal/analysis/simplifycompositelit: preserve comments in fixes golang/tools
  2. [2] data/reports: add 3 reports golang/vulndb
  3. [3] data/reports: add 43 reports golang/vulndb
  4. [4] cmd/compile: add '-d=ssa/phase/@keyword=value' option golang/go
  5. [5] cmd/compile: fix mergelocals on mips/mips64 golang/go
  6. [6] crypto/tls: avoid overflow in parseECHConfigList golang/go
  7. [7] go/analysis/suite/vet: add sqlrowserr, scannererr analyzers golang/tools
  8. [8] cmd/golangorg: redirect goprevplay and gotipplay to go.dev/play golang/website
  9. [9] cmd/golangorg: redirect go2goplay.golang.org to go.dev/play golang/website

Quick answers

What shipped in Go on July 23, 2026?
A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem. In total, 21 commits landed.
Who contributed to Go on July 23, 2026?
11 developers shipped this update, including Jean Barkhuysen, Hana Kim, David Chase, Sean Liao, Cuong Manh Le, Keith Randall, Nicholas S. Husin, and cuishuang, and 3 more.
What were the notable Go updates?
gopls/internal/analysis/simplifycompositelit: preserve comments in fixes, data/reports: add 3 reports, and data/reports: add 43 reports.

More from @golang

Go @golang

COMPILER SHRINKS CODE SIZE WHILE QUIC FIXES BUSY-LOOP HANGS

The Go compiler now frees unused registers at loop headers, cutting generated code size across all architectures, while the net package fixes a critical QUIC keep-alive deadlock that was burning CPU on blocked connections.

Josh Bleecher Snyder Ilya Torbin Jake Bailey Filippo Valsorda +7
go 25 shipped 1-min read
Go @golang

COMPILER CLEANUP AND PROXY BEHAVIOR FIXES SHIP ACROSS THE STACK

Go's compiler gets leaner while net/http fixes a decade-old proxy environment variable ambiguity that's finally caught up with the rest of the ecosystem.

Ilya Torbin Alan Donovan Daniel Morsing Nicholas S. Husin +2
go 19 shipped 1-min read
Go @golang

GO TOOLCHAIN BUILD FLAGS GET PRECISION FIX, CGO PROBE ESCAPES WRAPPER TRAP

The go command's cgo compiler version detection was running under -toolexec when it shouldn't have been, breaking builds for anyone wrapping their toolchain.

harjoth Andreas Bolka
go 2 shipped 1-min read
Go @golang

GOPLS TIGHTENS PROTOCOL TYPES AS EXP ADDS TRAJECTORY UTILITIES

gopls just locked down its LSP protocol with stronger enum typing, while the experimental track opens a new eval/trajectory module for advanced analysis workflows.

Hongxiang Jiang
go 2 shipped 1-min read

Daily updates, in your inbox

Follow Go

What actually shipped in Go, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN REFRESHES MODEL PROFILES, OPENROUTER 0.2.7 SHIPS

OpenRouter integration lands with updated model profiles including Google's Gemini 3.5 Flash Lite, while core token counting gets a performance fix for multi-tool agents.

github-actions[bot] langchain-oss-model-profiles langchain-oss-model-profiles[bot] imnishitha +6
ai-agents 29 shipped 1-min read
Local LLMs Local LLMs

OLLAMA AGENTS NOW IMPORT SKILLS FROM CODEX AND CLAUDE

Ollama shipped a skills import system that lets coding agents pull validated skill directories from external sources, while simultaneous fixes to GLM tool-call parsing and Laguna model alignment prevent agents from silently failing.

ParthSareen dhiltgen m1el rankaiyx +10
llms 212 shipped 2-min read
CachyOS @CachyOS

BRAVE BROWSER SOURCES SHIFT TO APT, GAME RULES SURGE, GERMAN WIKI TRANSLATIONS ACCELERATE

CachyOS is consolidating Brave packaging around apt sources while ananicy-rules absorbs a massive gaming ruleset expansion and the wiki team pushes German localization across multiple docs.

Vladislav Nepogodin Piotr Gorski lukaogadze Matias +1
infra 81 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR FIXES CALENDAR AND COMPILER EDGE CASES ACROSS FIVE PATCHES

Alexander Gubarev landed five targeted fixes to Calendar.ISO and ParallelCompiler that close gaps in time parsing, validation guards, and documentation.

Alexander Gubarev
elixir 15 shipped 1-min read
Want every project, not just this one?