$ the-wire · showcase
GOPLS FIXES COMMENT HANDLING IN COMPOSITE LITERALS, VULNDB ADDS 46 SECURITY REPORTS
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
11 people shipped this
Hana Kim
@hyangah
2 cited
Ian Alexander
@jitsu-net
2 cited
David Chase
@dr2chase
1 cited
Keith Randall
@randall77
1 cited
Nicholas S. Husin
@nicholashusin
1 cited
cuishuang
@cuishuang
1 cited
Alan Donovan
@adonovan
1 cited
Jean Barkhuysen
@jeanbza
Sean Liao
@seankhliao
Cuong Manh Le
@cuonglm
Hongxiang Jiang
@h9jiang
A critical gopls bug that corrupted code when comments appeared in composite literals is fixed, while the vulnerability database absorbs a major batch of 46 new security reports across the ecosystem.
Gopls shipped a fix for a code generation bug where suggested simplifications of redundant pointer composite literals would delete the wrong character when comments appeared between the ampersand and the type name [1]. The fix uses separate text edits to preserve inline comments while producing the same output as gofmt -s. On the vulnerability side, golang/vulndb merged two batches totaling 46 new security reports [2][3] covering various packages, continuing the steady ingestion of CVE data into the official Go vulnerability database. The compiler desk added developer-friendly tuning options with a new '-d=ssa/phase/@keyword=value' flag to simplify experimentation [4], while fixing edge cases in mergelocals on MIPS architectures [5] and plugging an overflow vulnerability in TLS ECH config parsing [6]. The golang/tools suite also gained two new analyzers for SQL row and scanner error handling that will ship with go1.28 [7]. Website infrastructure now redirects the legacy playground domains goprevplay, gotipplay, and go2goplay to go.dev/play [8][9], consolidating the playground experience. Across all desks, 21 commits landed addressing compiler robustness, tooling quality, and ecosystem vulnerability tracking.
Action items
- → Update gopls to the latest version with the composite literal comment fix golang/tools [plan]
- → Review golang/vulndb for newly reported vulnerabilities in your dependencies golang/vulndb [monitor]
- → Update any bookmarks pointing to goprevplay or gotipplay to go.dev/play golang/website [plan]
References
- [1] gopls/internal/analysis/simplifycompositelit: preserve comments in fixes ↗ golang/tools
- [2] data/reports: add 3 reports ↗ golang/vulndb
- [3] data/reports: add 43 reports ↗ golang/vulndb
- [4] cmd/compile: add '-d=ssa/phase/@keyword=value' option ↗ golang/go
- [5] cmd/compile: fix mergelocals on mips/mips64 ↗ golang/go
- [6] crypto/tls: avoid overflow in parseECHConfigList ↗ golang/go
- [7] go/analysis/suite/vet: add sqlrowserr, scannererr analyzers ↗ golang/tools
- [8] cmd/golangorg: redirect goprevplay and gotipplay to go.dev/play ↗ golang/website
- [9] cmd/golangorg: redirect go2goplay.golang.org to go.dev/play ↗ golang/website
